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OVERSIGHT OF FEDERAL EFFORTS TO 
ADDRESS ELECTROMAGNETIC RISKS 


Tuesday, May 17, 2016 

U.S. House of Representatives, 

Committee on Homeland Security, 

Subcommittee on Oversight and 
Management Efficiency, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:07 a.m., in Room 
311, Cannon House Office Building, Hon. Scott Perry [Chairman of 
the subcommittee] presiding. 

Present: Representatives Perry, Duncan, Clawson, Carter, 
Loudermilk, Watson Coleman, and Torres. 

Also present: Representative Franks. 

Mr. Perry. The Committee on Homeland Security Subcommittee 
on Oversight and Management Efficiency will come to order. 

The purpose of this hearing is to receive testimony regarding the 
Federal Government’s efforts to address risks associated with elec- 
tromagnetic pulse, or EMP, events. 

The Chair asks unanimous consent to allow the gentleman from 
Arizona, Mr. Franks, the opportunity to participate in today’s hear- 
ing. 

Without objection, so ordered. 

The Chair now recognizes himself for an opening statement. 

America’s energy infrastructure is the heart that pumps the 
American economy. Long-term power outages resulting from an at- 
tack on our critical infrastructure could cripple our Nation’s econ- 
omy and put America’s health and safety in jeopardy. Because the 
Nation’s critical infrastructure is so vital to America’s way of life, 
the Federal Government has recognized the necessity of securing 
our infrastructure from an array of risks, including the threat of 
EMP, electromagnetic pulse, attack. 

The most serious EMP risk would come in the form of an EMP 
resulting from a nuclear detonation at high altitude. Such an at- 
tack could cause long-term damage to the power grid. While many 
believe the likelihood of such an attack is low, the damage and eco- 
nomic aftershocks that would follow demand that we address these 
risks. We cannot discount that other nation-states, such as North 
Korea, or sophisticated terror groups might want to utilized EMP 
to wreak havoc on our economy. 

The Departments of Homeland Security and Energy and the Fed- 
eral Energy Regulatory Commission have an active role in pro- 
tecting our critical infrastructure. According to a GAO, Government 
Accountability Office, report released last month. Federal agencies 

( 1 ) 
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have taken action — it is important to note — have taken action to 
prepare and mitigate EMP risks, but there is still room for im- 
provement, as always. 

According to GAO, DHS and Department of Energy have ad- 
dressed some but not all of the recommendations in a 2008 report 
from the Congressionally-authorized EMP Commission. Unfortu- 
nately, DHS has yet to clearly identify a lead office or official with- 
in the Department to coordinate efforts internally and with other 
Federal and industry stakeholders. How can DHS protect us 
against EMP risks if they don’t know who is in charge? I expect 
to hear from DHS’s witness today on how the Department has cor- 
rected this failure. 

GAO has also found that Federal partners must do a better job 
of collaborating their planning activities. Additionally, GAO made 
recommendations to improve how DHS analyzes EMP risks and 
how DHS and DOE identify and implement key research and de- 
velopment priorities. 

Overall, GAO found that the Federal Government’s efforts to pre- 
pare for and mitigate EMP risks are at best a mixed bag. The 
progress made to date is certainly due in part to Congress’ over- 
sight efforts and the recommendations made in 2008 by the EMP 
Commission. DHS and DOE must make more headway in their ef- 
forts to address EMP. Effectively engaging the private sector to as- 
sist with planning and building system resiliency will be an essen- 
tial component of these efforts. 

Congress must also do its part. In November 2015, the House 
passed H.R. 1073, the Critical Infrastructure Protection Act, au- 
thorized by Congressman Trent Franks of Arizona, which would re- 
quire better planning research and development for EMP risks. 
Unfortunately, like many other bills passed by this committee, it 
remains stuck in the Senate. 

I certainly appreciate the hard work of our watchdogs at GAO for 
their report and the witnesses for appearing before this sub- 
committee today. I look forward to hearing how Federal agencies 
will work to improve themselves in light of GAO’s findings to better 
protect the American people from EMP risks. 

[The statement of Chairman Perry follows:] 

Statement of Chairman Scott Perry 
May 17, 2016 

America’s energy infrastructure is the heart that pumps the American economy. 
Long-term power outages resulting from an attack on our critical infrastructure 
could cripple our Nation’s economy and put Americans’ health and safety in jeop- 
ardy. Because the Nation’s critical infrastructure is so vital to Americans’ way of 
life, the Federal Government has recognized the necessity of securing our infrastruc- 
ture from an array of risks, including the threat of an electromagnetic pulse (EMP) 
attack. The most serious EMP risk would come in the form of an EMP resulting 
from a nuclear detonation at high altitude. Such an attack could cause long-term 
damage to the power grid. While many believe the likelihood of such an attack is 
low, the damage and economic aftershocks that would follow demand that we ad- 
dress these risks. We cannot discount that other nation-states, such as North Korea, 
or sophisticated terror groups might want to utilize an EMP to wreak havoc on our 
economy. 

The Departments of Homeland Security and Energy, and Federal Energy Regu- 
latory Commission have an active role in protecting our critical infrastructure. Ac- 
cording to a Government Accountability Office (GAO) report released last month. 
Federal agencies have taken action to prepare and mitigate EMP risks, but there’s 
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still room for improvement. According to GAO, DHS and the Department of Energy 
have addressed some but not all of the recommendations in a 2008 report from the 
Congressionally-authorized EMP Commission. 

Unfortunately, DHS has yet to clearly identify a lead office or official within the 
Department to coordinate efforts internally and with other Federal and industry 
stakeholders. How can DHS protect us against EMP risks if they don’t know who 
is in charge? I expect to hear from DHS’s witness today on how the Department 
has corrected this failure. GAO also found that Federal partners must do a better 
job of collaborating their planning activities. Additionally, GAO made recommenda- 
tions to improve how DHS analyzes EMP risks and how DHS and DOE identify and 
implement key research and development priorities. 

Overall, GAO found that the Federal Government’s efforts to prepare for and miti- 
gate EMP risks are at best, a mixed bag. The progress made to date is certainly 
due, in part, to Congress’s oversight efforts and the recommendations made in 2008 
by the EMP Commission. DHS and DOE must make more headway in their efforts 
to address EMP. Effectively engaging the private sector to assist with planning and 
building system resiliency will be an essential component of these efforts. 

Congress must also do its part. In November 2015, the House passed H.R. 1073, 
the Critical Infrastructure Protection Act, authored by Congressman Trent Franks 
of Arizona, which would require better planning, research, and development for 
EMP risks. Unfortunately like many other bills passed by this committee, it remains 
stuck in the Senate. 

I appreciate the hard work of our watchdogs at GAO for their report and the wit- 
nesses for appearing before the subcommittee today. I look forward to hearing how 
Federal agencies will work to improve themselves, in light of GAO’s findings, to bet- 
ter protect the American people from EMP risks. 

Mr. Perry. The Chair now recognizes the Ranking Member of 
the subcommittee, the gentlelady from New Jersey, Mrs. Watson 
Coleman. 

Mrs. Watson Coleman. Thank you, Mr. Perry. Thank you for 
holding today’s hearing. 

Thank you to Messrs. Chris Currie, Brandon Wales, Joseph 
McClelland, and Jud Freed for your testimony today. 

The Department of Homeland Security is tasked with the overall 
safety and security of the United States. Last week, the Depart- 
ment revealed a new mission statement: “With honor and integrity, 
we will safeguard the American people, our homeland, and our val- 
ues.” 

One risk to the homeland is an EMP, or electromagnetic pulse — 
is a burst of electromagnetic radiation that results from suddenly 
fluctuating magnetic fields. An EMP can be either man-made or 
natural and can damage high-voltage transformers and possibly 
contribute to grid failure and electric power blackouts. 

EMPs are considered a high-impact, yet low-probability risk oc- 
currence. As DHS tries to prioritize its efforts across a wide spec- 
trum of potential dangers to the Nation, it should take seriously all 
risks impacting the homeland, not only EMPs but also climate 
change impacts, solar storms, and a wide range of natural disas- 
ters. 

Last month, the Government Accountability Office released a re- 
port reviewing the Department’s assessment and coordination ef- 
forts in the EMP space. According to GAO, DHS components, in- 
cluding NPPD, FEMA, and S&T, conduct independent activities ad- 
dressing EMPs, including research and development, stakeholder 
coordination, and mitigation. However, no specific component has 
been tasked with lead responsibility for coordinating activities 
within the Department or with Federal and industry stakeholders. 
Further, the Department has not fully leveraged opportunities to 
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collect key inputs often used in a risk assessment, such as threat 
vulnerability and consequences information. 

Risk assessments are a beneficial means of incorporating meth- 
ods or tools to reach a specific identifiable conclusion. Specifically, 
with the use of a risk assessment, the Department can better char- 
acterize the risk of EMPs in the overall protection mission. 

In 2007, this committee passed the 9/11 Commission Act, which 
required the Department to produce the Quadrennial Homeland 
Security Review, a document produced every 4 years for the pur- 
pose of comprehensively examining the Department’s homeland se- 
curity strategy and risk priorities. Thus far, 2 QHSRs have been 
created, and it is my view that the latest 2014 release showed im- 
provement from the 2010 review, but the Department still needs 
improvement in the way it assesses its risk, such as EMPs. 

In the coming weeks, I will introduce legislation that addresses 
the importance of risk assessment in the development of the 
QHSR, specifically the need for detailed documented methods for 
gauging homeland security threats. In order to determine roles and 
responsibilities for the Department, as GAO suggests, DHS must 
first determine where EMP fits in the overall protective strategy 
for the Department. 

With that, Mr. Chairman, I yield back the balance of my time. 

[The statement of Ranking Member Watson Coleman follows:] 

Statement of Ranking Member Bonnie Watson Coleman 
May 17, 2016 

The Department of Homeland Security is tasked with the overall safety and secu- 
rity of the United States. Last week, the Department revealed a new mission state- 
ment: With honor and integrity, we will safeguard the American people, our home- 
land, and our values. 

One risk to the homeland, an EMP, or Electromagnetic Pulse, is a hurst of electro- 
magnetic radiation that results from suddenly fluctuating magnetic fields. 

An EMP can be either man-made or natural and can damage high-voltage trans- 
formers and possibly contribute to grid failure and electric power blackouts. EMPs 
are considered a high-impact, low-probability risk occurrence. 

As DHS tries to prioritize its efforts across a wide spectrum of potential dangers 
to the Nation, it should take seriously all risks impacting the homeland, not only 
EMPs but also climate change impacts, solar storms, and a wide range of natural 
disasters. 

Last month, the Government Accountability Office released a report reviewing the 
Department’s assessment and coordination efforts in the EMP space. According to 
GAO, DHS components, including NPPD, FEMA, and S&T conduct independent ac- 
tivities addressing EMPs including research and development, stakeholder coordina- 
tion, and mitigation. 

However, no specific component has been tasked with lead responsibility for co- 
ordinating activities within the Department or with Federal and industry stake- 
holders. Further, the Department has not fully leveraged opportunities to collect key 
inputs often used in a risk assessment, such as threat, vulnerability, and con- 
sequences information. 

Risk assessments are a beneficial means of incorporating methods or tools to 
reach a specific, identifiable conclusion. Specifically, with the use of a risk assess- 
ment, the Department can better characterize the risk of EMPs in its overall protec- 
tive mission. 

In 2007, this committee passed the 9/11 Commission Act, which required the De- 
partment to produce the Quadrennial Homeland Security Review, a document pro- 
duced every 4 years for the purpose of comprehensively examining the Department’s 
homeland security strategy and risk priorities. 

Thus far, 2 QHSRs have been created. It is my view that the latest 2014 release 
showed improvements from the 2010 review, but the Department still needs im- 
provement in the way it assesses its risks, such as EMPs. 
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In the coming weeks, I will introduce legislation that addresses the importance 
of risk assessments in the development of the QHSR, specifically the need for a de- 
tailed, documented method for gauging homeland security threats. 

In order to determine roles and responsibilities within the Department as GAO 
suggests, DHS must first determine where EMPs fit in the overall protective strat- 
egy for the Department. 

Mr. Perry. The Chair thanks the gentlelady. 

Other Members of the subcommittee are reminded that opening 
statements may be submitted for the record. 

[The statement of Ranking Member Thompson follows:] 

Statement of Ranking Member Bennie G. Thompson 
May 17, 2016 

An electromagnetic pulse or EMP is a burst of electromagnetic radiation created 
when a nuclear weapon is detonated or when a non-nuclear EMP weapon is used. 
Additionally, naturally-occurring solar weather can generate effects similar to other 
EMP events. 

An EMP could cause catastrophic damage to our Nation’s critical infrastructure. 
An EMP is a high-impact, low-probability risk. Over the past 10 years, 92 percent 
of counties have had at least 1 Presidential disaster declaration issued; however, 
none of them were for an EMP. 

This does not mean that we should be dismissive of the threat; however, we have 
the responsibility to examine the Federal Government’s efforts, while making sure 
that we do not use our platforms to promote fear in the minds of the American pub- 
lic. 

As the lead agency coordinating the Federal Government’s efforts to promote the 
security and resiliency of the Nation’s critical infrastructure, the Department of 
Homeland Security must take this threat, and all threats to the Nation’s critical in- 
frastructure, seriously. 

Last month, the Government Accountability Office issued a report detailing the 
Department’s work in the EMP space and determined that DHS has not fully identi- 
fied its risk assessments when it comes to an EMP attack. 

GAO also found that DHS officials could not identify any DHS representatives or 
offices as having broader designated responsibility for performing key oversight or 
coordination roles regarding electromagnetic risks within DHS’s overall infrastruc- 
ture protection efforts. According to GAO, stakeholders are unclear who within DHS 
is responsible for addressing electromagnetic risks. 

This leaves me to ask an age-old question that I have asked the Department on 
several occasions with regard to various responsibilities across several components — 
“Who’s in Charge?” While the Department of Homeland Security is 2 years into its 
“Unity of Effort” initiative, GAO’s findings, while not shocking, are concerning. 

This is also troubling because as part of the Department’s effort to become more 
unified, the National Protection and Programs Directorate is looking to Congress for 
authorization for a reorganization. This reorganization includes having an infra- 
structure directorate that works with the public and private sectors on threats to 
physical and cyber infrastructure. 

Congressional leaders need to know what if any impact a NPPD reorganization 
would have on the Department’s responsibilities with oversight of the threat from 
EMP and where EMP fits in the Department’s overall infrastructure protection 
strategy. We also need to know how the infrastructure directorate would plan on 
working with Federal, State, and local stakeholders when it comes to infrastructure 
security. 

I look forward to the testimony from today’s witnesses that can provide greater 
context to how the Government, in particular DHS, is dealing with the threat from 
EMP, including how DHS will address risk assessments and continue to work with 
outside stakeholders. 

Finally, I am pleased that the Ranking Member of this subcommittee has taken 
the initiative to introduce legislation that addresses the importance of risk assess- 
ments, and I look forward to cosponsoring her legislation. 

Mr. Perry. We are pleased to have a distinguished panel of wit- 
nesses before us today. The witnesses’ entire written statements 
will appear in the record. The Chair will introduce all of the wit- 
ness first and then recognize each of you for your statements. 
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At this time, I ask unanimous consent that the statement from 
the Department of Energy for the record from Patricia Hoffman is 
entered in the record. 

Without objection. 

[The information follows:] 

Statement of Patricia Hoffman, Assistant Secretary, Office of Electricity 
Delivery and Energy Reliability, U.S. Department of Energy 

May 17, 2016 

Chairman Perry, Ranking Member Watson Coleman, and Members of the sub- 
committee, thank you for continuing to highlight the importance of a resilient elec- 
tric power grid. I appreciate the opportunity to address the Department of Energy’s 
role in in helping to ensure a resilient, reliable, and flexible electricity system in 
an increasingly challenging environment. 

Our economy. National security, and even the health and safety of our citizens 
depend on the reliable delivery of electricity. The mission of the Office of Electricity 
Delivery and Energy Reliability (DOE-OE) is to strengthen, transform, and improve 
energy infrastructure to ensure access to reliable, secure, and clean sources of en- 
ergy. We are committed to working with our public and private-sector partners to 
protect the Nation’s critical energy infrastructure, including the electric power grid, 
from disruptions caused by natural and man-made events, such as severe weather, 
physical attacks, cyber attacks, and electromagnetic pulses (EMP). 

The electrical grid is more than just infrastructure. It is an ecosystem of asset 
owners, manufacturers, service providers, and Government officials at Federal, 
State, and local levels, all working together to run one of the most reliable power 
grids in the world. Ninety percent of the Nation’s energy infrastructure is in private 
hands, and 3,306 electricity providers serve approximately 148 million customers ^ 
through a network of 460,000 miles of high-voltage transmission lines. 

There are plenty of risks beyond cyber, including physical, severe weather, nat- 
ural disasters, aging infrastructure, and infrastructure interdependencies. In the 
face of these diverse threats, we can help ensure that the grid is poised to recover 
quickly following an incident. Fostering partnerships with public and private stake- 
holders plays a critical and necessary role in this work. 

THE ECOSYSTEM OF RESILIENCE 

A crucial factor to meeting these challenges is to be proactive and cultivate what 
I call an ecosystem of resilience: A network of producers, distributors, regulators, 
vendors, and public partners, acting together to strengthen our ability to prepare, 
respond, and recover. We continue to partner with industry, other Federal agencies, 
local governments, and other stakeholders to quickly identify threats, develop in- 
depth strategies to mitigate those threats, and rapidly respond to any disruptions. 

Our resilience efforts are further bolstered by our broader grid modernization ac- 
tivities, including our support of the research, development, and demonstration of 
advanced technologies and our work with State, local. Tribal, and territorial stake- 
holders to help them improve their local resilience and energy emergency response 
capabilities. Of the $4.5 billion that we invested in grid modernization through the 
American Recovery and Reinvestment Act (ARRA), $3.4 billion was used to help in- 
dustry accelerate the deployment of advanced technologies that are now reducing 
costs and keeping the lights on more reliably and efficiently. This smarter grid is 
helping to prevent outages, reduce storm impacts, and restore service faster when 
outages occur. 

Our model is partnerships first. We are all in this together. It is through working 
together that we continue to strengthen our ability to bounce back following an 
event. 


PARTNERSHIPS FOR READINESS 

DOE-OE has been working with utility owners and operators, regulators, and 
State and local officials across the country concerning threats to cybersecurity and 
other risks. Through these partnerships, we are providing tools, best practices, new 
technologies, and funds to support their many on-going efforts. 


1 American Public Power Association (APPA), “U.S. Electric Utility Industry Statistics” http:! / 
www.publicpower.org I files / PDFs / USElectricUtilityIndustryStatistics.pdf . 
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We directly support preparedness efforts at the community level, in part through 
products and tools produced by our Infrastructure Security and Energy Restoration 
(ISER) division, to inform and educate State and local officials in their energy emer- 
gency preparedness activities. This is done through forums, training, and tabletop 
exercises for Federal, State, and local energy officials. 

In early February, DOE Secretary Ernest Moniz signed an updated Energy Emer- 
gency Assurance Coordinators (EEAC) Agreement with the National Association of 
State Energy Officials (NASEO), National Association of Regulatory Utility Commis- 
sioners (NARUC), National Governors Association (NGA), and National Emergency 
Management Association (NEMA). This updated EEAC Agreement lays out concrete 
items to improve our collective ability to share information, which is essential for 
making sound response and restoration decisions during emergencies. To support 
this effort, DOE and State officials will develop information-sharing protocols and 
processes to streamline response operations. We will also test these processes and 
information-sharing mechanisms through routine drills and exercises. 

The President’s fiscal year 2017 budget request includes $15 million for a State 
Energy Assurance program to foster regional hazard preparedness. This program 
would focus on providing State, local. Tribal, and territorial governments with anal- 
ysis, training, and exercising of shared regional risk factors where entities depend 
on each other for energy supplies and must work together to resolve energy disrup- 
tions to restore energy infrastructure. 

This new program would be facilitated through competitive regional cooperative 
assistance awards to State and local partners. As needed, DOE, including our Na- 
tional Laboratory expertise and capability, would be available to the awardees to 
enhance preparation and allow for real-world energy emergency support. Lessons 
learned would be shared with other communities to leverage the program across the 
Nation and help improve resiliency planning. 

DOE-OE also focuses on enabling our State, local, and utility partners with infor- 
mation. EAGLE-I (Environment for Analysis of Geo-Located Energy Information), 
for example, is a DOE-designed and operated web tool that automatically gathers 
electrical grid service status data from company websites every 15 minutes, and or- 
ganizes it into an easy-to-read picture of electrical service status Nation-wide. Now 
covering 75 percent of all U.S. electricity customers, it provides real-time informa- 
tion about the grid — what is up, what is down, the number and location of outages, 
when service is restored — to DOE and, through our information-sharing efforts, with 
other Federal agencies. 

Geomagnetic Disturbanees ( GMD) or Spaee Weather 

President Obama and the administration recognize the threat posed by a GMD 
from space weather and the administration continues to prioritize work to address 
these concerns. In April 2015, the Quadrennial Energy Review highlighted methods 
to reduce our electric grid’s vulnerabilities to multiple forms of risks. The Secretary 
of Energy has prioritized DOE efforts to help understand and mitigate these risks 
for the electricity subsector (subsector). 

In 2015 the administration issued the National Space Weather Strategy and fol- 
low-up National Space Weather Action Plan to better understand and address the 
risks of geomagnetic storms. The plans gave DOE primary responsibility for 2 of the 
actions in the Action Plan. First, by the end of 2016, DOE will coordinate with regu- 
latory agencies and the electric power industry to define data requirements that fa- 
cilitate a centralized reporting system to collect real-time information on the status 
of the electric power transmission and distribution system during geomagnetic 
storms. Second, also by the end of 2016, DOE, in coordination with Departments 
of Homeland Security and Commerce, and stakeholders in the subsector, will de- 
velop plans to provide monitoring and data collection systems to inform a system- 
wide, real-time view of geomagnetically induced currents (GICs) at the regional level 
and, to the extent possible, display the status of power generation, transmission, 
and distribution systems during geomagnetic storms. 

For several years DOE has taken actions and funded efforts to better understand 
the risk from space weather. Our space weather strategy included analysis, enhanc- 
ing science, and collaboration with stakeholders both domestically and internation- 
ally. Efforts include: 

• Encouraging the development of a North American Reliability Corporation 
(NERC) GMD task force and supporting it to better understand space weather. 
The task force developed standards for GMD. In addition to monitoring geo- 
magnetic disturbances, industry is prepared to take action as needed, including 
reducing load if necessary and changing operational settings to respond to sys- 
tem needs. 
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• Funding the Electric Power Research Institute’s (EPRI) SUNBURST program, 
a geomagnetically-induced current monitoring system. When our support began 
there were only 10 monitors, all in the Eastern Interconnection. Now there are 
over 40 and they are in all 3 major grids in the Continental United States 

• Funding a new program to evaluate and install variometers to collect and share 
data on changes on magnetic fields during GMDs. Our program will put in 12 
variometers to help system owners and operators better model the expected po- 
tential currents going into transformers causing grid and possible system dam- 
age. With the data grid operators can take informed risk-based decisions on ac- 
tions to mitigate and protect against GMDs. Prior to the deployment of the first 
variometer, the United States Geological Survey had only 6 magnetometers to 
measure such data. 

• Funding a study at Oak Ridge National Laboratory (ORNL) to evaluate the sus- 
ceptibility of the eastern grid to GMD. The study will be completed by year’s 
end. 

• Organizing, attending, and participating in several space weather workshops 
with government and industry stakeholders, including those from some of our 
allies such as Canada, the United Kingdom, and Ireland. 

Electromagnetic Pulses (EMP) 

DOE has increased its efforts to better understand the EMP threat to the electric 
grid and what measures can mitigate its potential adverse impacts. DOE plans to 
take the necessary steps to develop cost-effective strategies for all hazards to miti- 
gate, respond to, and recover from potential disruptions. We have a multi-pronged 
approach to addressing EMP threats, allowing the subsector to advance readiness 
for potential EMP impacts through research to quantify the threat, scientific devel- 
opment of mitigation strategies, and analysis of the policies needed for the future. 

A recent GAO Report 16-243 from March 2016 presented recommendations to 
Federal agencies on methods to address EMP. DOE concurred with the report’s rec- 
ommendations to DOE, including that the “Secretary of Energy direct responsible 
officials to engage with Federal partners and industry stakeholders to identify and 
implement key EMP research and development priorities, including opportunities 
for further testing and evaluation of potential EMP protection and mitigation op- 
tions.” 

The Fixing America’s Surface Transportation Act of 2015 (FAST Act, Pub. L. 114- 
94) also gives the Department impetus to enhance planning for events such as EMP. 
In the Act, Congress enhanced the Secretary of Energy’s abilities to take emergency 
actions related to grid operations during a grid security emergency caused by any 
high-impact event such as an EMP attack. 

Other on-going or planned activities related to EMP include: 

• The Department is analyzing the vulnerability of the grid to an EMP event and 
the potential impact on reliability and delivery of electric power. The analysis 
will examine options such as hardening, blocking, stockpiles, and planning. 

• The Department is conducting a risk analysis for “extreme events” including 
EMP electricity industry planning. 

• The Department is working jointly with the Department of Homeland Security 
through Los Alamos National Laboratory and DHS’s National Infrastructure 
Simulation and Analysis Center to begin developing methods to analyze the im- 
pact and consequences of different sources of EMP and GMD events on U.S. 
electric power infrastructure and to use those methods to determine events of 
concern. 

DOE is committed to helping forge the grid of the future that will be more resil- 
ient to all hazards, including EMP. Continued progress in grid modernization is 
vital to helping us protect the grid from EMP. 

PARTNERSHIPS FOR RESPONSE 

Our partnerships with private and public stakeholders also focus on quickly iden- 
tifying threats, developing in-depth strategies to mitigate them and rapidly respond- 
ing to any disruptions. With 90 percent of the Nation’s power infrastructure pri- 
vately held, coordinating and aligning efforts between the Government and the pri- 
vate sector is the only viable path to success. 

Under Presidential Policy Directive-21: Critical Infrastructure Security and Resil- 
ience and the FAST Act, DOE is the Sector-Specific Agency (SSA) for electrical in- 
frastructure. The SSA plays the pivotal role of ensuring unity of effort and message 
across Government partners, including the Department of Homeland Security, the 
Department of Defense, and DOE offices. 

As the Energy SSA we also serve as the day-to-day Federal interface for the 
prioritization and coordination of activities to strengthen the security and resilience 
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of critical infrastructure in the electricity subsector. This involves building, main- 
taining, and advancing our relationships and collaborative efforts with the energy 
sector. We have invested in public/private partnership programs and initiatives that 
involve sharing real-time information, assessing vulnerabilities, clarif 3 dng respon- 
sibilities, and engaging in training and exercises. 

In addition, the Department of Energy serves as the lead agency for Emergency 
Support Function 12 (ESF-12) under the National Response Framework. As the 
lead for ESF-12, the DOE is responsible for facilitating the restoration of damaged 
energy infrastructure. During a response operation, the Department works with in- 
dustry and Federal/State/local partners to: 

• Assess disaster impacts on local and regional energy infrastructure; 

• Coordinate asset delivery to repair damaged infrastructure; 

• Monitor and report on restoration efforts; and 

• Provide regular situational awareness updates to key decision makers in the ad- 
ministration and our interagency partners. 

To achieve these operational priorities, the Department deploys responders who 
work directly with the affected utilities and local officials on the ground during a 
disaster. The responders provide expertise on a variety of energy issues, and have 
direct access to our subject-matter experts in Washington, DC who work with our 
interagency partners to coordinate the appropriate waivers, when needed, to further 
speed restoration efforts. In extreme cases, the Department can use its legal au- 
thorities under the Federal Power Act, Defense Production Act, and other statutes 
to assist in response and recovery operations. 

The National electricity infrastructure spans 19,000 power plants, 450,000 miles 
of transmission lines, 55,000 substations, and 6 million miles of distribution lines. 
The grid is truly a National system of complex systems, where small variations in 
power output or quality can be felt almost instantly several States away. That said, 
every piece of that infrastructure is local. 

Threats ranging from a fallen tree to a dedicated hacker from overseas can threat- 
en the broader transmission system and the distribution system. When the power 
goes out, the local utility is the first responder. Should any threat or emergency ex- 
ceed local public or private resources or require a full-blown National response, a 
utility CEO, a representative trade association member of the Electricity Subsector 
Coordinating Council (ESCC), the Electricity Information Sharing and Analysis 
Center (E-ISAC), or the Federal Government can request what is called a Crisis 
State Activity. Crisis State Activities are coordinated through the ESCC because, as 
with preparedness, we respond through partnerships. The ESCC is a group of lead- 
ers from across the electricity subsector that meet regularly with Government to co- 
ordinate and share information. Together, we work toward collective actions to ad- 
dress the threat or risk. 

Congress enacted several important new energy security measures in the FAST 
Act. The Secretary of Energy was provided a new authority, upon declaration of a 
Grid Security Emergency by the President, to issue emergency orders to protect or 
restore critical electric infrastructure or defense critical electric infrastructure. This 
authority allows DOE to respond as needed to the threat of cyber and physical at- 
tacks on the grid. DOE is developing a proposed rule of procedure regarding this 
new authority. 

The FAST Act codifies DOE’s role as the lead SSA for energy sector cyber incident 
coordination. These actions provide a central point of contact for the energy sector 
and can expedite recovery from cyber and physical incidents.The FAST Act protec- 
tions afforded to critical electric infrastructure information provide essential infor- 
mation-sharing tools to enhance the Federal Government’s situational awareness 
while assuring the private sector that sensitive information on vulnerabilities will 
be safeguarded. DOE looks forward to consulting on the forthcoming Federal Energy 
Regulatory Commission (FERC) critical electric infrastructure information ruling. 

The FAST Act will also enable a more robust response for energy incidents, and 
DOE is on track to implement the energy security provisions. 

PARTNERSHIPS FOR INNOVATION 

Innovation and preparedness are vital to grid resilience. In January 2016, the 
DOE built upon its Grid Modernization Initiative — an on-going effort that reflects 
the Obama administration’s commitment to improving the resiliency, reliability, and 
security of the Nation’s electricity delivery system — by releasing a comprehensive 
new Grid Modernization Multi-Year Program Plan (MYPP). The MYPP, developed 
in close collaboration with a wide range of key external partners, lays out a blue- 
print for DOE’s research, development, and demonstration agenda to enable a mod- 
ernized grid, building on concepts and recommendations from the first installment 



10 


of the Quadrennial Energy Review (QER) and Quadrennial Technology Review 
(QTR). 

For example, large power transformers are critical to grid resilience, and are ripe 
for innovation. These important grid assets can weigh hundreds of tons, are expen- 
sive, and are typically custom made with procurement lead times of a year or more. 
A significant number of damaged transformers from any type of hazard could result 
in a long-term impact on the overall resilience of the grid. The QER recognized the 
risks associated with the loss of large power transformers. The QER recommended 
that DOE work with other Federal agencies. States, and industry on an initiative 
to mitigate these risks. Approaches envisioned in the QER include the development 
of 1 or more strategic transformer reserves through a staged process, beginning with 
an assessment of technical specifications and whether new Federal regulatory au- 
thorities or cost-share are necessary and appropriate. 

The Transformer Resilience and Advanced Components (TRAC) program includes 
a number of R&D activities to improve the resilience of transformers. Replacing 
aging grid assets with outdated technology leads to infrastructure lock-in that in- 
creases the total cost of grid modernization. The typical lead time between a large 
power transformer order and delivery ranges from 5 to 12 months for domestic pro- 
ducers and 6 to 16 months for producers outside the United States. The President’s 
fiscal year 2017 budget request of $15 million for TRAC will help develop cost-effec- 
tive, next-generation components that are inherently more resilient. 

The FAST Act (Sec. 61004) also addressed this issue and requires DOE in con- 
sultation with FERC, the ESCC, Energy Reliability Organization (ERO), and owners 
and operators of critical electric infrastructure to submit a plan to Congress evalu- 
ating the feasibility of establishing a Strategic Transformer Reserve for the storage, 
in strategically-located facilities, of spare large power transformers in sufficient 
numbers to temporarily replace critically damaged large power transformers. The 
plan is to include an analysis of the degree to which electricity subsector initiatives 
including utility ownership, sharing agreements, etc., satisfy needs and funding op- 
tions including fees on owners and operators and public-private cost share with in- 
dustry. In January, DOE-OE awarded the analysis project to a team led by the Oak 
Ridge National Laboratory. The team includes researchers from the University of 
Tennessee-Knoxville, Sandia National Laboratories, the Electric Power Research In- 
stitute, and Dominion Virginia Power. 

Secretary Moniz also announced last January an award of up to $220 million over 
3 years, subject to Congressional appropriations, to DOE’s National Laboratories 
and partners to support critical research and development in advanced storage sys- 
tems, clean energy integration, standards and test procedures, and a number of 
other key grid modernization areas. This Grid Modernization Laboratory Consor- 
tium effort recognizes regional differences and will strengthen regional strategies 
while defining a diverse and balanced National strategy. In addition to projects that 
address the needs of incorporating individual grid technologies like solar or energy 
storage, DOE is also developing cross-cutting projects that have an impact across 
multiple technologies. As Secretary Moniz said at the announcement, “Modernizing 
the U.S. electrical grid is essential to reducing carbon emissions, creating safe- 
guards against attacks on our infrastructure, and keeping the lights on.” 

Energy storage is a key technology for whole-grid resilience. Energy storage fun- 
damentally changes the relationship between when energy is produced and when it 
is consumed. The President’s fiscal year 2017 budget request supports OE’s work 
on materials research, device development, demonstrations, and grid analysis to 
help transition selected energy storage technologies from R&D to industrially rel- 
evant scales with improved safety, industry acceptance, and reduced cost. Improved 
energy storage technologies will enable the stability, resiliency, and reliability of the 
future electric utility grid, as well as increased deplo 3 unent of variable renewable 
energy resources. 

We have been proactive in advancing technologies to modernize and make our 
grids smarter and more adaptive to the challenges posed by threats to the grid. For 
example, DOE-OE has made key investments in the area of synchrophasor tech- 
nology, which reduces grid vulnerabilities by providing timely and accurate power 
outage information and better self-healing capabilities, and has also invested in 
microgrids, which keep local communities up and running during regional and other 
outages and help supply power to affected areas. 

Many of these projects are working in local jurisdictions throughout the United 
States. Supporting the research, development, and deployment of next-generation 
technologies enhances the grid’s ability to recover quickly from disruptions. 
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CONCLUSION 

Threats continue to evolve, and DOE is working diligently to stay ahead of the 
curve. The solution is an ecosystem of resilience that works in partnership with 
local, State, and industry stakeholders to help provide the methods, strategies, and 
tools needed to help protect local communities through increased resilience and 
flexibility. To accomplish this, we must accelerate information sharing to inform bet- 
ter local investment decisions, encourage innovation and the use of best practices 
to help raise the energy sector’s security maturity, and strengthen local incident re- 
sponse and recovery capabilities, especially through participation in training pro- 
grams and disaster and threat exercises. 

Building an ecosystem of resilience is — by definition — a shared endeavor, and 
keeping a focus on local communities remains an imperative. Because DOE has 
spent decades building — and continues to build — local partnerships and investing in 
technologies to enhance resilience, the grid is better able to withstand and recover 
quickly from disasters and attacks. 

Mr. Perry. All right. Mr. Chris Currie is the director of GAO’s 
Homeland Security and Justice Team, where he leads the agency’s 
work on emergency management, National preparedness, and crit- 
ical infrastructure protection issues. In this role, he evaluates Fed- 
eral efforts and programs to prevent, plan for, and respond to nat- 
ural and man-made disasters. Prior to this position, he served as 
an acting director in GAO’s Defense Capabilities and Management 
Team, where he led reviews of Department of Defense programs. 

Welcome. 

Mr. Brandon Wales is the director of the Office of Cyber and In- 
frastructure Analysis at the Department of Homeland Security. His 
office provides integrated analysis of cyber and physical risk to the 
Nation’s critical infrastructure. Previously, Mr. Wales was the di- 
rector of the Homeland Infrastructure Threat and Risk Analysis 
Center. 

Welcome. 

Mr. Joseph McClelland is the director of the Office of Energy In- 
frastructure Security at the Federal Energy Regulatory Commis- 
sion, or FERC. His works with Federal and State agencies and the 
energy industry to minimize risk to the Nation’s energy infrastruc- 
ture. Mr. McClelland joined the Commission in 2004 and has more 
than 20 years of experience in the electric utility industry. He is 
a graduate of the Pennsylvania State University. 

Welcome. 

Mr. Judson Freed is the director of the Office of Emergency Man- 
agement and Homeland Security for Ramsey County, Minnesota — 
thanks for traveling here today, sir — and is testifying on behalf of 
the National Association of Counties in his capacity as the vice 
chair of its subcommittee on homeland security and emergency 
management. The association represents elected and appointed offi- 
cials in over 3,000 counties across the Nation. 

Thank you all for being here today. 

The Chair now recognizes Mr. Currie for your statement, sir. 

STATEMENT OF CHRIS P. CURRIE, DIRECTOR, HOMELAND SE- 
CURITY AND JUSTICE ISSUES, U.S. GOVERNMENT ACCOUNT- 
ABILITY OFFICE 

Mr. Currie. Well, thank you. Chairman Perry, and thank you. 
Ranking Member Watson Coleman, as well, and other Members of 
the subcommittee. I appreciate the chance to be here to discuss our 
recent report on Federal efforts to address electromagnetic risks. 
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Within the United States, there are 16 critical infrastructure sec- 
tors — for example, water, transportation, communications, and, of 
course, energy. The energy sector ties all of these sectors together, 
and without it the others can’t function. This makes protecting it 
a National security priority. 

One of the greatest threats to the electric grid is an EMP, or 
electromagnetic pulse; also, a natural solar weather event. These 
are also called GMDs, or geomagnetic disturbances. Both could 
cause large power outages over a long period of time. 

The concern was so great that Congress established the EMP 
Commission in 2001. It issued reports in 2004 and 2008, and most 
of the recommendations were aimed at the Departments of Home- 
land Security and Energy. 

Now, DHS and DOE are not required in law to implement the 
Commission recommendations; however, we found that many of the 
recommendations align with responsibilities that both departments 
already have. For example, various laws and Presidential directives 
already require DHS and DOE to assess the risks to critical infra- 
structure assets and prioritize those. 

DHS, DOE, and FERC have all taken some action, as the Chair- 
man noted, to address electromagnetic risks. Most of these actions 
are indirect, since electric infrastructure is mainly owned by the 
private sector. But here are some examples: 

DHS and DOE have invested in research to study the vulner- 
ability of large, high-voltage transformers to EMPs, GMDs, and 
other natural disasters. These transformers are particularly critical 
to our electric grid. They are also expensive, large, and difficult to 
replace quickly. 

In the response area, FEMA is developing a specific plan to ad- 
dress long-term power outages, and while it is not specific to elec- 
tromagnetic risks, this plan would describe how the Federal Gov- 
ernment would respond and recover from a long power outage. 

Just to be clear, while some of these actions align with certain 
EMP Commission recommendations, there has not been a com- 
prehensive, holistic effort to address them. There are still whole or 
part recommendations that remain open. 

Now, the next question is, what more should we expect the Fed- 
eral Government to do? We found several areas where Federal ef- 
forts need to be strengthened. 

First, it wasn’t clear and, frankly, there was a bit of confusion 
within DHS for who exactly should be responsible for electro- 
magnetic risks. As I mentioned, various components took action, 
but there is no designated lead for coordinating all of these efforts 
together. We think this is important, not just to clarify things with- 
in DHS, but also so DHS’s partners, like DOD, DOE, FERC, and 
the industry, know who to work with. We recommended that DHS 
designate roles and responsibilities, and they fully agreed with 
that. 

We also found that much more needs to be done to identify and 
prioritize key electric-sector infrastructure. Neither DHS nor DOE 
could identify actions in this area. While FERC did conduct a re- 
view in 2013 of certain critical electric-sector substations, DHS and 
DOE were not involved at that time. What we recommended is that 
DHS and DOE review FERC’s assessment and determine what 
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more needs to be done to assess and prioritize assets. Both agen- 
cies fully agreed with us and are now taking some action to ad- 
dress that. 

Last, more needs to be done to coordinate and prioritize efforts 
across the departmental stovepipes. This includes areas like re- 
search and the testing and development of mitigation and protec- 
tion technologies. Recently, there’s been more focus and coordina- 
tion on natural solar events through efforts like the White House 
National Space Weather Action Plan, but this plan addresses only 
natural events, not EMPs. 

We recommend that DHS and DOE better coordinate with each 
other and the industry — and that is critical — to identify and imple- 
ment EMP research and development priorities. Importantly, this 
would include coordinating to test and evaluate potential EMP pro- 
tection options. Both agencies agreed and told us they plan to work 
with industry over the next year or so to develop that. 

So we will continue to monitor DHS and DOE’s progress in im- 
plementing these recommendations moving ahead. That completes 
my prepared remarks. I would be happy to answer your questions. 

[The prepared statement of Mr. Currie follows:] 

Prepared Statement of Chris P. Currie 
May 17, 2016 

CRITICAL INFRASTRUCTURE PROTECTION. — FEDERAL EFFORTS TO ADDRESS 

electromagnetic risks 

GAO-16-641T 

Chairman Perry, Ranking Member Watson Coleman, and Members of the sub- 
committee: I am pleased to be here today to discuss our March 2016 report on Fed- 
eral efforts to address electromagnetic risks to the electric grid.^ Electromagnetic 
risks caused by a man-made electromagnetic pulse (EMP) or a naturally-occurring 
solar weather event could have a significant impact on the Nation’s electric grid as 
well as other infrastructure sectors that depend on electricity, such as communica- 
tions. The impact of these events could lead to power outages over broad geographic 
areas for extended durations. Addressing these events necessitates effective collabo- 
ration among multiple Government agencies and industry partners, as no single 
Federal program or entity has sole responsibility for addressing electromagnetic 
risks. In April 2008, the Commission to Assess the Threat to the United States from 
Electromagnetic Pulse Attack (EMP Commission)^ issued a report that included 


^GAO, Critical Infrastructure Protection: Federal Agencies Have Taken Aetions to Address 
Electromagnetic Risks, hut Opportunities Exist to Further Assess Risks and Strengthen Collabo- 
ration, GAO-16-243 (Washington, DC: Mar. 24, 2016). 

2 Established pursuant to the National Defense Authorization Act for Fiscal Year 2001, the 
EMP Commission was responsible for assessing the following: (1) The nature and magnitude of 
potential high-altitude EMP threats to the United States; (2) the vulnerability of U.S. military 
and civilian systems to an EMP attack in terms of emergency preparedness; (3) the capability 
of the United States to repair and recover from damage inflicted by an EMP attack; and (4) 
the feasibility and cost of hardening selected military and civilian systems against EMP attack. 
See Pub. L. No. 106-398, §§1401-09, 114 Stat. 1654, 1654A-345-348 (2000). See also Pub. L. 
No. 109-163, § 1052, 119 Stat. 3136, 3434—35 (2006) (reestablishing the EMP Commission to 
continue its efforts to monitor, investigate, make recommendations, and report to Congress on 
the evolving threat to the United States in the event of an EMP attack resulting from the deto- 
nation of a nuclear weapon or weapons at high altitude) and Pub. L. No. 110—181, Div. A, § 1075 
122 Stat. 3, 333 (2008) (providing, among other things, that the EMP Commission and the Sec- 
retary of Homeland Security shall jointly ensure that the work of the EMP Commission with 
respect to EMP attack on electricity infrastructure, and protection against such attack, is coordi- 
nated with DHS efforts on such matters). The National Defense Authorization Act for Fiscal 
Year 2016 once again reestablishes the EMP Commission but with an expanded purpose that 
includes the evolving threat from, among other things, non-nuclear EMP weapons and natural 
EMP generated by geomagnetic storms. See Pub. L. No. 114-92, § 1089, 129 Stat. 726, 1015- 
16 (2015). 
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over 90 recommendations addressing the preparation for, and protection and recov- 
ery from, a possible EMP attack against U.S. critical infrastructure. The majority 
of these recommendations were made to the Department of Homeland Security 
(DHS) and to the Department of Energy (DOE). 

According to experts, a nuclear EMP is the burst of electromagnetic radiation re- 
sulting from the detonation of a nuclear device, which can disrupt or destroy elec- 
tronic equipment. Non-nuclear EMP weapons can also be designed to intentionally 
disrupt electronics, but these generally have short range and are not a threat to 
multiple assets. In addition to man-made EMPs, naturally-occurring solar weather 
events of sufficient intensity can also cause electromagnetic impacts that can ad- 
versely affect components of the commercial electric grid, as well as other infrastruc- 
ture such as satellites and undersea cables. The resulting impact of a solar weather 
event is commonly referred to as a geomagnetic disturbance (GMD). In 1989, a GMD 
caused wide-scale impacts on the Hydro-Quebec power system in Canada which 
caused this regional electric grid to collapse within 92 seconds and left 6 million cus- 
tomers without power for up to 9 hours. 

The National Infrastructure Protection Plan (NIPP) outlines the roles and respon- 
sibilities of DHS and applicable sector-specific agencies for each of the 16 critical 
infrastructure sectors.^ DHS has the lead role in coordinating the overall Federal 
effort to promote the security and resilience of the Nation’s critical infrastructure 
and DOE — as the sector-specific agency for the energy sector, which includes critical 
electrical infrastructure — shares responsibility with DHS. Other Federal agencies 
working to address the threat of EMP and GMD include the Department of Defense 
(DOD) and the Federal Energy Regulatory Commission (FERC), as well as the Na- 
tional Oceanographic and Atmospheric Administration (NOAA), the U.S. Geological 
Survey (USGS), and the National Aeronautics and Space Administration (NASA). 

As noted in Presidential Policy Directive 21, the energy and communications sec- 
tors are uniquely critical due to the enabling functions they provide to other critical 
infrastructure sectors.’^ The U.S. electric power delivery system is a highly complex 
network of substations and electric lines that transport electricity from generators 
to residential, commercial, and industrial consumers. Approximately 85 percent of 
the Nation’s critical electrical infrastructure is owned and operated by private in- 
dustry. 

My statement today summarizes the findings from our March 2016 report, and 
like the report, addresses: (1) The extent to which key Federal agencies have taken 
actions to address electromagnetic risks to the electric grid, including how these ac- 
tions align with selected recommendations from the 2008 EMP Commission report 
and (2) the extent to which additional opportunities, if any, exist to enhance Federal 
efforts in addressing those risks to the electric grid. To conduct this work, we re- 
viewed program documents, research reports, applicable risk assessments, and other 
supporting documentation related to electromagnetic risks and interviewed agency 
officials at DHS, DOE, DOD, FERC, and NOAA. We also interviewed officials from 
industry associations, subject-matter experts from research organizations, product 
manufacturers, and electric utility operators. More detailed information on our 
scope and methodology can be found in our March 2016 report.® We conducted the 
work on which this statement is based in accordance with generally accepted Gov- 
ernment auditing standards. 

FEDERAL AGENCIES HAVE TAKEN VARIOUS ACTIONS TO ADDRESS ELECTROMAGNETIC 
RISKS; SOME ACTIONS ALIGN WITH THE 2008 EMP COMMISSION RECOMMENDATIONS 

DHS, DOE, and FERC have taken various actions to address electromagnetic 
risks to the electric grid, and these actions generally fall into 4 categories: (1) Stand- 
ards, guidelines, tools, and demonstration projects; (2) research reports; (3) strategy 
development and planning; and (4) training and outreach. Additionally, some of the 
actions DHS and DOE have taken generally aligned with recommendations made 
by the EMP Commission. 

Because Federal agencies generally do not own electric grid infrastructure. Fed- 
eral actions to address GMD risks are more indirect through such things as devel- 


^ DHS, National Infrastructure Protection Plan, Partnering for Critical Infrastructure Security 
and Resilience (Washington, DC: December 2013). Sector-specific agencies are the Federal de- 
partments and agencies responsible for providing institutional knowledge and specialized exper- 
tise, as well as leading, facilitating, or supporting the security and resilience programs and asso- 
ciated activities of their designated critical infrastructure sector in the all-hazards environment. 

'^Presidential Policy Directive— 21, Critical Infrastructure Security and Resilience (Feb. 12, 
2013) (identifying, among other things, the 16 critical infrastructure sectors and the sector-spe- 
cific agencies), 
s GAO-16-243. 
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oping standards and guidelines, and conducting research that could benefit electric 
grid owners and operators. Federal agencies have also been involved in strategy de- 
velopment and planning, as well as training and outreach efforts, as a means of pre- 
paring Federal officials and others to respond to both EMP and GMD events, and 
enhancing knowledge about electromagnetic risks. For example, DHS’s Science and 
Technology Directorate (S&T) led the design and development of a prototype trans- 
former that can be more easily transported to another location to help restore elec- 
tric power in a timelier manner. DHS has also participated in various training and 
outreach events to enhance understanding of EMP and GMD events. DOE’s primary 
efforts include supporting research to enhance the understanding of the potential 
impacts to the electric grid from electromagnetic events. More detailed information 
on key Eederal agencies’ actions taken since 2008 to address electromagnetic risks 
can be found in Appendix II of our March 2016 report.® 

Although DHS and DOE did not report that any of their actions were taken in 
response to the EMP Commission recommendations, some actions taken by both 
agencies have aligned with some of the recommendations. Specifically, of the 7 rec- 
ommendations made by the EMP Commission related to the electric grid,^ some of 
the actions that DHS and DOE took aligned with 4 of them: Conducting research 
to better understand the interdependencies of critical infrastructures, addressing 
the vulnerability of control systems to an EMP attack; identifying responsibilities 
for responding to an EMP attack; and utilizing industry and other Governmental 
institutions to assure the most cost-effective outcomes.® Eor example, with respect 
to the recommendation on conducting research to better understand interdepend- 
encies of critical infrastructures, DHffs Sector Resilience Report: Electric Power De- 
livery includes some assessment of how various critical infrastructures — including 
the energy, communications, and transportation sectors, among others — are inter- 
dependent in maintaining operations. For more detailed information regarding how 
identified Federal actions align with these 7 EMP Commission recommendations, 
see Appendix III of our March 2016 report.® 

ADDITIONAL OPPORTUNITIES EXIST TO ENHANCE FEDERAL EFFORTS TO ADDRESS 
ELECTROMAGNETIC RISKS TO THE ELECTRIC GRID 

DHS Has Not Clearly Identified Roles and Responsibilities for Addressing Electro- 
magnetic Risks 

In our March 2016 report, we found that DHS had not clearly identified internal 
roles and responsibilities for addressing electromagnetic risks to the electric grid or 
communicated these to external Federal and industry partners. While multiple DHS 
components and offices, including the National Protection and Programs Directorate 
(NPPD), the Federal Emergency Management Agency (FEMA), and S&T, had each 
conducted independent activities addressing electromagnetic risks to the electric 
grid, none had been tasked with lead responsibility for coordinating related activi- 
ties within the Department or with Eederal and industry stakeholders. As a result, 
during the course of our review for our March 2016 report, we experienced on-going 
challenges in identifying applicable DHS personnel and related Departmental ac- 
tions. For example, NPPD officials had difficulty identifying their specific roles and 
activities addressing electromagnetic risks to the electric grid, including efforts to 
collect or synthesize available risk information to provide input into Department- 
wide risk assessments. 

Furthermore, industry representatives and other Federal officials told us it is not 
clear who within DHS is responsible for addressing electromagnetic risks. The 2008 
EMP Commission report recommended that DHS make clear its authority and re- 
sponsibilities, as well as delineate the functioning interfaces with other Govern- 
mental institutions, regarding EMP response efforts. We concluded that designating 
internal roles and responsibilities within DHS regarding electromagnetic risks and 


6 GAO-16-243. 

"^The 7 EMP Commission recommendations related to the electric grid include the following: 
(1) Conducting research to better understand infrastructure systems and interdependencies; (2) 
expanding activities to address the vulnerability of control systems; (3) identifying clear author- 
ity and responsibility to respond to an EMP attack; (4) engaging Federal and industry entities 
to determine liabilities and funding; (5) establishing monitoring efforts and defining testing 
standards and metrics; (6) providing capabilities to help protect the electric grid from an EMP 
attack and recover as rapidly and effectively as possible; and (7) utilizing industry and Govern- 
mental institutions to assure cost-effective outcomes. 

®With regard to the last multi-part recommendation identified above, DHS and DOE took 
some actions that aligned with 5 of the 15 subparts of this recommendation. Some of the sub- 
parts include such efforts as developing National and regional restoration plans and assuring 
the availability of critical communication channels, among other efforts. 

® GAO-16-243. 
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communicating these to Federal and industry partners could provide additional 
awareness of related activities and help ensure more effective and coordinated en- 
gagement with other Federal agencies and industry stakeholders, and could help re- 
duce the risk of potential duplication, overlap, or fragmentation within the Depart- 
ment or across Federal agencies. 

In our March 2016 report, we recommended DHS designate roles and responsibil- 
ities within the Department for addressing electromagnetic risks and communicate 
these to Federal and industry partners. DHS concurred with our recommendation 
and reported that their Office of Policy is coordinating across the Department to 
identify and document applicable roles and responsibilities regarding electro- 
magnetic issues to ensure full mission coverage while minimizing potential overlap 
or redundancy and expects to complete this effort by December 2016. These actions, 
if implemented effectively, should address the intent of our recommendation. 

DHS and DOE Have Not Fully Addressed NIPP Requirement to Identify Key Elec- 
trical Infrastructure Assets 

In our March 2016 report, we found that DHS and DOE had not taken actions 
to identify key electrical infrastructure assets as required given their respective crit- 
ical infrastructure responsibilities under the NIPP. The NIPP explicitly states that 
to manage critical infrastructure risk effectively, partners must identify the assets, 
systems, and networks that are essential to their continued operation, considering 
associated dependencies and interdependencies of other infrastructure sectors. The 
2008 EMP Commission report also recommended that DHS and DOE prioritize 
nodes that are critical for the rapid recovery of other key sectors that rely upon elec- 
tricity to function, including those assets that must remain in service or be restored 
within hours of an EMP attack. Neither DHS nor DOE reported any specific actions 
taken to identify critical electrical infrastructure as part of risk management efforts 
for the energy sector, including any systematic review of a 2013 FERC analysis of 
critical substations, or any further collaboration to determine the key elements of 
criticality that they believe should be considered when evaluating the vast array of 
infrastructure assets constituting the U.S. electric grid. The extensive size and scope 
of the electric power system necessitates collaboration among partners to ensure all 
individual expertise is effectively leveraged. 

As a result, we recommended in our March 2016 report that DHS and DOE direct 
responsible officials to review FERC’s electrical infrastructure analysis and collabo- 
rate to determine whether further assessment is needed to adequately identify crit- 
ical electric infrastructure assets. DHS and DOE each concurred with our rec- 
ommendation. DHS reported that NPPD is to collaborate with FERC to identify crit- 
ical electrical infrastructure assets beginning with the evaluation of critical sub- 
stations identified by FERC, and will explore elements of criticality that might not 
have been considered by FERC, in coordination with DOE. DOE stated that its Of- 
fice of Electricity Delivery and Energy Reliability will review FERC’s electrical in- 
frastructure analysis and will work with FERC and DHS to identify any additional 
elements of criticality and determine if further assessment is needed. Both DHS and 
DOE expect to complete these efforts by March 2017. These actions should address 
the intent of our recommendation. 

DHS Has Not Fully Leveraged Existing Opportunities to Collect and Analyze Infor- 
mation on Electromagnetic Risks 

We found in March 2016 that although DHS components had independently con- 
ducted some efforts to assess electromagnetic risks, the Department had not fully 
leveraged available risk information or conducted a comprehensive analysis of these 
risks. Within the Office of Policy, there is recognition that “space weather” and 
“power grid failure” are significant risk events, which DHS officials have determined 
pose great risk to the security of the Nation. However, DHS officials were unable 
to provide detailed information about the specific risk inputs — namely threat, vul- 
nerability, and consequence information — that were used to assess how electro- 
magnetic events compared to other risk events, or how these inputs were used to 
inform DHS’s applicable risk-management priorities. Further, officials within NPPD 
were unable to identify any specific actions taken or plans to systematically collect 
or analyze risk information regarding electromagnetic impacts to the electric grid 
as part of Department-wide risk assessment efforts. 

According to the NIPP, to assess risk effectively, critical infrastructure partners — 
including owners and operators, sector councils, and Government agencies — need 
timely, reliable, and actionable information regarding threats, vulnerabilities, and 
consequences. Additionally, the electric grid remains vulnerable to other potential 
threats, such as physical and cyber attacks. We concluded that better collection of 
threat, vulnerability, and consequence information through existing DHS programs 
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and strengthened collaboration with Federal partners could help DHS better assess 
the relative risk ranking of electromagnetic events versus other risks and help in- 
form asset protection priorities. Moreover, according to subject-matter experts, the 
impact to the electric grid from electromagnetic threats may vary substantially by 
location, network, and operating characteristics, and other factors. For example, key 
reports on GMD indicate that high-voltage transformers located at higher latitudes 
in the United States are likely subject to increased potential for adverse impacts 
from GMD events than those at lower latitudes. Further collection of information 
on sector interdependencies could also help DHS to assess the potential economic 
consequences associated with long-term power outages and provide information to 
help assess the cost-effectiveness of various mitigation strategies. 

In our March 2016 report, we recommended that DHS’s NPPD and Office of Infra- 
structure Protection (IP) work with other Federal and industry partners to collect 
and analyze key inputs on threat, vulnerability, and consequences related to electro- 
magnetic risks. DHS concurred with our recommendation and reported that the De- 
partment has initiated efforts to assess electromagnetic risk and help determine pri- 
orities. For example, DHS stated the Department has a joint study with DOE under 
way that will analyze the hazard environments, impacts, and consequences of dif- 
ferent sources of EMP and GMD on the electric grid to determine events of concern 
and potential means of mitigation. DHS expects to implement these efforts by De- 
cember 2016 and if implemented effectively, should address the intent of our rec- 
ommendation. 

Federal Agencies Have Not Fully Coordinated Efforts to Implement EMP Risk Man- 
agement Activities 

We also found in March 2016 that key Federal agencies, including DHS and DOE, 
as well as industry partners had not established a fully coordinated approach to 
identifying and implementing risk management activities to address EMP risks. Ac- 
cording to the NIPP Risk Management Framework, such activities include identi- 
fying and prioritizing research and development efforts, and evaluating potential 
mitigation options, including the cost-effectiveness of specific protective equipment. 
The publication of the National Space Weather Action Plan in October 2015 identi- 
fied many key Federal activities in these areas regarding the GMD risk; however, 
no similar efforts had been proposed regarding EMP risks to the electric grid.i° 

DHS officials stated an EMP attack generally remains a lower-risk priority com- 
pared to other risk events with higher probability such as natural disasters or cyber 
attacks. DOE officials also noted resource limitations and competing priorities as 
the key driver for not pursuing additional risk management activities specifically re- 
lated to EMP events. However, we found that even if an EMP attack is not deter- 
mined to be among the highest-resource priorities for DHS and DOE relative to 
other risk events, there are opportunities for enhanced collaboration among Federal 
agencies and industry stakeholders to address identified gaps and help ensure that 
limited resources are more effectively coordinated and prioritized. For example, re- 
cent reports issued by DOE and a leading research organization for the electric in- 
dustry identified gaps in the information available regarding likely EMP impacts to 
modern grid technologies and electronic control systems. They noted that such infor- 
mation remains important for developing applicable protective guidelines and equip- 
ment design specifications. 

In our March 2016 report, we recommended that DHS and DOE engage with Fed- 
eral partners and industry stakeholders to identify and implement key EMP re- 
search and development priorities, including opportunities for further testing and 
evaluation of potential EMP protection and mitigation options. DHS and DOE con- 
curred with our recommendation and each identified actions to convene applicable 
stakeholders to jointly determine mitigation options and conduct further testing and 
evaluation. DHS stated S&T will work with DOE and the Electricity Subsector Co- 
ordinating Council to develop a joint Government and industry approach to identify 
options for mitigating the consequences of an EMP event. DHS expects to imple- 
ment this effort by September 2016. In addition, DOE stated it is working with the 
Electric Power Research Institute to develop an EMP Strategy that is scheduled for 
completion by August 31, 2016, and the strategy is to be followed by a more detailed 
action plan identifying research and development priorities and specific opportuni- 
ties to test and evaluate EMP mitigation and protection measures. If implemented 


i*’ White House, National Space Weather Action Plan (Washington, DC: October 2015). Among 
other actions, the National Space Weather Action Plan lays out responsibilities for Federal enti- 
ties to establish benchmarks for space weather events, which are intended to serve as inputs 
into such activities as developing vulnerability assessments, creating engineering standards, and 
developing more effective mitigation practices and procedures. 
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effectively, DHS and DOE’s actions should address the intent of our recommenda- 
tion. 

We will continue to monitor DHS and DOE actions taken to address our March 
2016 recommendations and have also recently initiated two additional reviews. One 
is evaluating the electromagnetic event preparedness of U.S. electricity providers 
and the other is a technical assessment of protective equipment designed to mitigate 
the potential impacts of a GMD on electrical infrastructure. We expect these 
projects to be completed by mid-2017. 

Chairman Perry, Ranking Member Watson Coleman, and Members of the sub- 
committee, this completes my prepared statement. I would be pleased to respond to 
any questions that you may have at this time. 

Mr. Perry. Thank you, Mr. Currie. 

The Chair recognizes Mr. Wales for his opening statement. 

STATEMENT OF BRANDON WALES, DIRECTOR, OFFICE OF 

CYBER AND INFRASTRUCTURE ANALYSIS, NATIONAL PRO- 
TECTION AND PROGRAMS DIRECTORATE, U.S. DEPARTMENT 

OF HOMELAND SECURITY 

Mr. Wales. Thank you, Chairman Perry, Ranking Member Wat- 
son Coleman, and distinguished Members of the committee. It is 
my pleasure to be here to discuss the threat posed by electro- 
magnetic pulse events, or EMP, to our Nation and our critical in- 
frastructure. 

Over the past several decades, the risk to digital and physical in- 
frastructures has grown. Today’s power grid and information net- 
works may be more vulnerable to EMP than those from a few dec- 
ades ago as the grid transitions from an analog to a digital system. 

My testimony today will focus on the Department of Homeland 
Security’s efforts to prepare for, respond to, and recover from a po- 
tential EMP attack, as well as touch on the joint DHS-Department 
of Energy effort to review the EMP science and provide a peer-re- 
viewed estimate of potential risks. 

As you know, an EMP is the burst of electromagnetic radiation 
created when a nuclear weapon is detonated or when a non-nuclear 
EMP weapon is used. EMPs can be high-frequency, similar to a 
flash of lightning, or low-frequency, similar to an aurora-induced 
phenomenon. 

The consequences of an EMP can range from permanent physical 
damage to temporary system disruptions and can result in fires, 
electric shocks to people and equipment, and critical service out- 
ages. EMP in some of its forms can cause wide-spread disruption 
and serious damage to electronic devices and networks, including 
those upon which many critical infrastructures rely. 

All critical infrastructure sectors are at risk from EMP, particu- 
larly those sectors that rely heavily on the electric grid and com- 
munications and information technology, such as industrial control 
systems. The complex interconnectivity among critical infrastruc- 
ture sectors means that EMP incidents will likely create cascading 
failures across sectors. 

We recognize that the Eederal Government plays an important 
role supporting the critical infrastructure community manage risks 
from low-probability, high-consequence events, such as EMPs and 
severe geomagnetic disturbances. DHS and its interagency part- 
ners are using our unique resources, built over the past decade, to 
address the scale and degree of uncertainty associated with EMP 
risk. 
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DHS has been working on the topic of EMP for a number of 
years, and we will continue working collaboratively both internally 
and with external stakeholders in various arenas to address the 
recommendations issued by the Government Accountability Office 
on this issue. 

The Office of Cyber and Infrastructure Analysis within DHS’s 
National Protection and Programs Directorate has partnered with 
the Department of Energy’s Office of Electricity Delivery and En- 
ergy Reliability to assess the impacts of EMP and geomagnetic dis- 
turbance events on electric power assets. 

This study, facilitated through DHS’s National Infrastructure 
Simulation and Analysis Center and DOE’s National Laboratories, 
is intended to develop scientifically rigorous, peer-reviewed meth- 
ods for assessing electric power asset impacts from EMP events. 
This study will include participation from the intelligence commu- 
nity, the broader interagency, the academic community, and the 
private sector when possible. We expect to complete this study in 
mid-2017. 

Our work also benefits from the activities of DHS’s National Cy- 
bersecurity and Communications Integration Center, or NCCIC. 
The NCCIC is an essential conduit within DHS to share informa- 
tion between the interagency community and the private sector on 
risks to the communication and control elements of our infrastruc- 
ture systems and has conducted past studies on EMP risks to com- 
munications infrastructure. 

In addition, the Office of Infrastructure Protection has a long his- 
tory of working with the private sector to enhance electric grid se- 
curity and resilience. This office conducts and facilitates vulner- 
ability and resilience assessments to help critical infrastructure 
owners and operators and State, local. Tribal, and territorial part- 
ners understand and address risks to their critical infrastructure. 

I would also like to recognize my colleagues’ activities at the 
Science and Technology Directorate and the Federal Emergency 
Management Agency. 

The Science and Technology Directorate has a mission to deliver 
effective and innovative insight, methods, and solutions for the crit- 
ical needs of the homeland security enterprise. Past research ef- 
forts on electric grid resilience have resulted in successes, such as 
the recovery transformer project, which is available to be deployed 
by the private sector today for risk reduction against a variety of 
hazards. 

Finally, the Federal Emergency Management Agency leads Fed- 
eral efforts to respond to and recover from impacts of a wide-spread 
disruption in the power grid regardless of cause. Through the de- 
velopment of the Power Outage Incident Annex, a collaboration of 
the Federal Government and the private sector, FEMA is enhanc- 
ing the existing response and recovery Federal interagency oper- 
ational plans. 

The Department of Homeland Security has since its inception 
pursued a deeper understanding of the EMP threat as well as its 
potential impacts and effective mitigation strategies. These efforts 
have been undertaken in cooperation with other Federal agencies 
and the private sector, and we are committed to continuing to ex- 
pand our focus on this issue as warranted by the risk environment. 
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The Department takes seriously the recent review and rec- 
ommendations of the Government Accountability Office on Federal 
efforts to address EMP risk and welcomes further cooperation with 
other Government agencies to ensure we are appropriately respon- 
sive on this critical topic. 

I want to thank the committee for the invitation to speak here 
today and for your on-going support for our work in this area. 
Thank you. 

[The prepared statement of Mr. Wales follows:] 

Prepared Statement of Brandon Wales 
May 17, 2016 

Thank you, Chairman Perry, Ranking Member Coleman, and distinguished Mem- 
bers of the committee. It is my pleasure to be here to discuss the threat posed by 
electromagnetic pulse events (EMP) to our Nation and its critical infrastructure, in- 
cluding its cyber, communications, and electric-grid assets. 

Over the past several decades, the risk to digital and physical infrastructures has 
grown. For example, today’s power grid and information networks may be more vul- 
nerable to EMP than those of a few decades ago, as the grid transitions from an 
analog system to a digital system to improve efficiency. My testimony today will 
focus on the Department of Homeland Security’s (DHS) preparations to respond to 
and assist recovery from a potential EMP attack, as well as touch on the joint DHS/ 
Department of Energy (DOE) effort to review the EMP science and provide a peer- 
reviewed estimate of the potential risks. 

The Federal Government plays an important role supporting the critical infra- 
structure community to manage risks from low-probability, high-consequence 
events, such as EMPs and severe geomagnetic disturbances (GMDs). DHS and its 
interagency partners will be using our unique resources built over the past decade 
to address the scale and degree of uncertainty associated with risks such as the ones 
I am here to discuss today. 

The Department takes seriously the recent review and recommendations of the 
Government Accountability Office (GAO) on Federal efforts to address EMP risk, as 
well as the recommendations issued by the 2008 EMP Commission, and welcomes 
further cooperation with other Government agencies to ensure we are appropriately 
responsive on this critical topic. 


BACKGROUND ON EMP 

An EMP is the burst of electromagnetic radiation created, for instance, when a 
nuclear weapon is detonated or when a non-nuclear EMP weapon is used. EMPs can 
be high-frequency, similar to a flash of lightning, or low-frequency, similar to an au- 
rora-induced phenomenon. The consequences of an EMP can range from permanent 
physical damage to temporary system disruptions, and can result in fires, electric 
shocks to people and equipment, and critical service outages. 

There are two general classes of EMP of concern: (1) Nuclear sources of EMP, 
such as High-altitude EMP (HEMP), and (2) Non-Nuclear sources of EMP (NNEP). 
HEMP results from a nuclear detonation typically occurring 15 or more miles above 
the Earth’s surface. The extent of HEMP effects depends on several factors includ- 
ing the altitude of the detonation, the weapon yield, and whether it was designed 
for EMP effects. On the ground, effects may be diminished by the electromagnetic 
shielding, or “hardening,” of assets. A high altitude burst could blanket the entire 
continental United States and could cause wide-spread impacts to multiple sectors, 
including to lifeline sectors such as the energy and communications. HEMP threat 
vectors can originate from a missile, such as a sea-launched ballistic missile; a sat- 
ellite asset; or a relatively low-cost balloon-borne vehicle. 

Non-Nuclear EMP (NNEP) can be created by sources such as Radio Frequency 
Weapons or Intentional Electromagnetic Interference devices, which are designed to 
produce sufficient electromagnetic energy to burn out or disrupt electronic compo- 
nents, systems, and networks. NNEP devices can be either electrically-driven, where 
they create narrowband or wideband microwaves, or explosively-driven, where an 
explosive is used to compress a magnetic field to generate the pulse. The range of 
an NNEP is fairly short (typically less than 1 kilometer) and faraday casings with 
line filters and surge arresters can mitigate much of the EMP effects. 
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POTENTIAL IMPACTS ON CRITICAL INFRASTRUCTURE 

In some of its forms, EMP can cause wide-spread disruption and serious damage 
to electronic devices and networks, including those upon which many critical infra- 
structures rely. There is uncertainty over the magnitude and duration of an electric 
power outage that may result from an EMP event due to ambiguity regarding the 
actual damage to electric power assets from an event. Any electric power outage re- 
sulting from an EMP event would ultimately depend upon a number of unknown 
factors and effects to assets that are challenging to accurately model, making it dif- 
ficult to provide high-specificity information to electric system planners and system 
operators. These variables include characteristics such as the EMP device type, the 
location of the blast, the height of the blast, the 3deld of the blast, and design and 
operating parameters of the electric power system subject to the blast. Secondary 
effects of EMP may harm people through induced fires, electric shocks, and disrup- 
tions of transportation and critical support systems, such as those at hospitals or 
sites like nuclear power plants and chemical facilities. 

All critical infrastructure sectors are at risk from EMP, particularly those sectors 
that rely heavily on communications and sensor (e.g., radar) technology, information 
technology, the electric grid, or that use a Supervisory Control and Data Acquisition 
system. The complex interconnectivity among critical infrastructure sectors means 
that EMP incidents that affect a single sector are likely affect other sectors — poten- 
tially resulting in additional failures. 

DHS EFFORTS TO ADDRESS GAO RECOMMENDATIONS 

DHS is working collaboratively, both internally and with external stakeholders, 
in various arenas to address the recommendations issued by GAO on this topic. 
DHS has been working on the topic of EMP for a number of years, and we will con- 
tinue working on it in the future. An example of our previous work on the topic of 
EMP includes a 2010 study on “Electromagnetic Pulse (EMP) Impacts on Extra 
High Voltage Power Transformers” conducted by the National Infrastructure Sim- 
ulation and Analysis Center for DHS. 

As part of DHS’s continuing commitment to this issue, there are resources across 
the Homeland Security enterprise engaged on this topic, including within the Fed- 
eral Emergency Management Agency (FEMA), the National Protection and Pro- 
grams Directorate (NPPD), and the Science and Technology Directorate (S&T). The 
scope of activity, as reviewed by GAO, falls into 3 areas of activity: (1) Risk assess- 
ment and analysis, (2) communication and coordination of threat information, and 
(3) research and development to mitigate EMP risks. 

NPPD’s involvement on EMP issues resides in a number of functional components 
including the Office of Cyber and Infrastructure Analysis (OCIA), the Office of Infra- 
structure Protection (IP), and the Office of Cybersecurity and Communications 
(CS&C). OCIA has partnered directly with the DOE’s Office of Electricity Delivery 
and Energy Reliability to assess the impacts of EMP and Geomagnetic disturbance 
events on electric power assets. This study, facilitated through DHS’s National In- 
frastructure Simulation and Analysis Center and DOE’s National Laboratories, is 
intended to develop scientifically rigorous, peer-reviewed methods for assessing elec- 
tric power asset impacts to EMP events. This study will include participation of the 
intelligence community, the broader interagency, the academic community, and the 
private sector, when possible. 

The EMP study by OCIA will leverage newly-started private-sector activities that 
are occurring through the Electric Power Research Institute, as well as previous 
government investments in research which have been sponsored by DHS and DOE. 
The estimated completion date of this risk analysis-based study of the electric power 
sector is approximately mid-2017. 

IP and OCIA continue to work collaboratively with the Department of Energy and 
the Federal Energy Regulatory Commission (FERC). As the GAO report indicates, 
collaboration can and should be increased with an emphasis on identification of crit- 
ical infrastructure assets of the electric power sector. Once identified, this list of as- 
sets can be used to guide protection and preparedness activities at DHS and to help 
prioritize response and recovery actions by DOE and DHS after a large-scale event. 
DHS is also increasing our collaboration with DOE and FERC in the near term, in- 
cluding additional collaboration between staff-level subject-matter experts. 

CS&C, which oversees the National Cybersecurity and Communications Integra- 
tion Center (NCCIC), has been assessing the potential risks to the communications 
and control elements of the electric grid from EMP, as well as radio frequency weap- 
ons, solar weather, and cyber threats for several years. As part of these efforts, the 
NCCIC developed the “EMP Protection Guidelines for Equipment, Facilities and 
Data Centers” report and provided related briefings to the Continuity of Govern- 
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ment community and to the Communications Sector, as well as other programs and 
sectors, to inform the community and help mitigate EMP and radio frequency weap- 
ons threats. The previously-mentioned joint study hy OCIA and DOE’s Office of 
Electricity Delivery and Energy will seek to learn and huild upon the knowledge 
and expertise gained from the NCCIC’s previous studies on this topic. 

FEMA continues to leverage the National Preparedness System to build, sustain, 
and deliver the capabilities needed to prevent, protect against, mitigate, respond to, 
and recover from the threats and hazards that pose the greatest risk, including 
risks to the energy sector. The tools and processes within the National Preparedness 
System include, but are not limited to, plans, training, and exercises for managing 
a variety of risks to the Nation’s infrastructure, including EMP and cyber 
vulnerabilities. 

FEMA is also actively developing their Power Outage Incident Annex to enhance 
the Response and Recovery Federal Interagency Operational Plans. The Annex, de- 
veloped in partnership with the Federal interagency community and the private sec- 
tor, will describe the process and organizational constructs through which the Fed- 
eral Government will respond to and recover from the impacts of a wide-spread dis- 
ruption in the power grid from any cause. 

Lastly, S&T develops near-term solutions to bridge capability gaps, and S&T has 
invested in multiple research programs for increasing the electric grid’s resilience 
against solar weather hazards. Previous research investments, such as the Recovery 
Transformer (RecX) project, are available for private-sector risk reduction on EMP 
and are available to be deployed by private-sector owners and operators today. 

CONCLUSION 

DHS, for many years, has pursued a deeper understanding of the EMP threat, 
as well as its potential impacts, effective mitigation strategies, and a greater level 
of public awareness and readiness. These efforts have been undertaken in coopera- 
tion with other Federal agencies and private-sector owners and operators; and we 
are committed to continuing to expand our focus on this issue, as warranted by the 
risk environment. 

I want to thank the committee for the invitation to speak here today and for your 
on-going support for our work in this area. I welcome your questions. 

Mr. Perry. Thank you, Mr. Wales. 

The Chair now recognizes Mr. McClelland. 

STATEMENT OF JOSEPH MCCLELLAND, DIRECTOR, OFFICE 

OF ENERGY INFRASTRUCTURE SECURITY, FEDERAL EN- 
ERGY REGULATORY COMMISSION, U.S. DEPARTMENT OF EN- 
ERGY 

Mr. McClelland. Chairman Perry, Ranking Member Watson 
Coleman, and distinguished Members of the subcommittee, thank 
you for the privilege to appear before you today to discuss electro- 
magnetic threats to the electric grid in the United States. 

My name is Joe McClelland, and I am the director of the Office 
of Energy Infrastructure Security at the Federal Energy Regulatory 
Commission, or FERC. I am here today as a FERC staff witness, 
and my remarks do not necessarily represent the views of FERC 
or any individual commissioner. 

Under section 215 of the Federal Power Act, FERC is entrusted 
with the responsibility to approve and enforce mandatory reliability 
standards for the Nation’s bulk power system. These standards are 
developed and proposed by the North American Electric Reliability 
Corporation, or NERC. 

Section 215 of the Federal Power Act provides a statutory foun- 
dation to develop reliability standards for the bulk power system. 
However, the nature of a National security threat by entities intent 
on attacking the United States by exploiting vulnerabilities in the 
electric grid using physical or cyber means stands in stark contrast 
to the other major reliability events that have caused regional 
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blackouts and reliability failures in the past. Wide-spread disrup- 
tion of electric service can quickly undermine the United States 
Government, its military, and the economy, as well as endanger 
the health and safety of its citizens. 

Congress took steps to address such a situation late last year. In 
the Fixing America’s Surface Transportation Act, or FAST Act, 
Congress assigned notable new authority to the Department of En- 
ergy, or DOE, and FERC, among other Federal agencies. 

Consistent with these requirements, FERC established our office, 
the Office of Energy Infrastructure Security, in late 2012 to provide 
a more agile and focused approach to growing cyber and physical 
security threats. Our office works collaboratively with industry to 
share information, including best practices, to help address threats 
from geomagnetic disturbances, GMD, or electromagnetic pulses, 
EMP. 

Just briefly, in 2001 Congress established a commission to assess 
and report on the threat from EMP. In 2004 and again in 2008, the 
Commission issued reports on these threats. 

One of the key findings in the reports was that a single EMP at- 
tack could seriously degrade or shut down a large part of the elec- 
tric power grid. Depending upon the attack, significant parts of the 
electric infrastructure could be, “out of service for periods measured 
in months to a year or more.” 

In order to better understand and quantify the effect of EMP and 
GMD on the power grid, FERC, DOE, and the Department of 
Homeland Security sponsored a study conducted by the Oak Ridge 
National Laboratory in 2010. The results of the study support the 
general conclusion of prior studies that EMP and GMD events pose 
substantial risk to equipment and operation of the Nation’s electric 
grid and, under extreme conditions, could result in major, long- 
term electrical outages. 

Unlike EMP attacks that are dependent upon the capability and 
intent of an attacker, GMD disturbances are inevitable, with only 
the timing and magnitude subject to variability. The Oak Ridge 
study assessed a solar storm that occurred in May 1921 which has 
been termed a 1-in-lOO-year event and applied it to today’s electric 
grid. The study concluded that such a storm could damage or de- 
stroy over 300 bulk power system transformers, interrupting serv- 
ice to 130 million people, with some outages lasting for a period of 
years. 

To help address GMD and EMP threats, FERC has applied both 
regulatory and collaborative actions. With respect to regulatory ac- 
tions, FERC has taken steps such as directing NERC to propose 
two reliability standards on GMD requiring new operational proce- 
dures and vulnerability assessments. 

With respect to collaborative actions, FERC works closely with 
Federal agencies. State agencies, and industry members in many 
ways. In general, such collaboration has included efforts to identify 
key energy facilities, conduct physical and cyber threat briefings 
and reviews to industry, including sessions on GMD and EMP, to 
assist with best practices for mitigation. 

Examples of such collaborative action includes FERC’s participa- 
tion on the SWORM — Space Weather Operations, Research, and 
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Mitigation — Task Force created in late 2014 by the National 
Science and Technology Council. 

In addition, as required by the FAST Act, DOE, in consultation 
with FERC and others, is developing a plan to establish a strategic 
transformer reserve. Specific to the subject of today’s hearing, the 
strategic transformer reserve plan will identify ways to decrease 
vulnerabilities from physical and cyber threats, including both 
EMP and GMD. 

Thank you again for the opportunity to testify today, and I would 
be happy to answer any questions you may have. 

[The prepared statement of Mr. McClelland follows:] 

Prepared Statement of Joseph McClelland 
May 17, 2016 

Chairman Perry, Ranking Member Watson Coleman and Members of the sub- 
committee: Thank you for the privilege to appear before you today to discuss electro- 
magnetic threats to the electric grid in the United States. My name is Joe 
McClelland and I am the director of the Federal Energy Regulatory Commission’s 
Office of Energy Infrastructure Security (OEIS). I am here today as a Commission 
staff witness, and my remarks do not necessarily represent the views of the Com- 
mission or any individual Commissioner. 

In the Energy Policy Act of 2005, Congress entrusted the Commission with a 
major new responsibility to approve and enforce mandatory reliability standards for 
the Nation’s bulk power system. This authority is in section 215 of the Federal 
Power Act. It is important to note that FERC’s jurisdiction and reliability authority 
under section 215 is limited to the “bulk power system,” as defined in the FPA, 
which excludes Alaska and Hawaii, as well as local distribution systems. Under the 
section 215 authority, FERC cannot author or modify reliability standards, but must 
depend upon an Electric Reliability Organization (ERO) to perform this task. The 
Commission certified the North American Electric Reliability Corporation (NERC) 
as the ERO. The ERO develops and proposes for the Commission’s review reliability 
standards or modifications, which the Commission can either approve or remand. 
If the Commission approves a proposed reliability standard, it becomes mandatory 
in the United States and is applicable to the users, owners, and operators of the 
bulk power system. If the Commission remands a proposed standard, it is sent back 
to the ERO for further consideration. The Commission is required to give “due 
weight” to the technical expertise of the ERO when reviewing any of NERC’s pro- 
posed standards. 

Section 215 of the Federal Power Act provides a statutory foundation for the ERO 
to develop reliability standards for the bulk power system. However, the nature of 
a National security threat by entities intent on attacking the United States by ex- 
ploiting vulnerabilities in its electric grid using physical or cyber means stands in 
stark contrast to other major reliability events that have caused regional blackouts 
and reliability failures in the past, such as events caused by tree-trimming prac- 
tices. Wide-spread disruption of electric service can quickly undermine the U.S. Gov- 
ernment, its military, and the economy, as well as endanger the health and safety 
of millions of citizens. 

I note that Congress took steps to address such a situation late last year, includ- 
ing in the Fixing America’s Surface Transportation Act (FAST Act) a section enti- 
tled, “Critical Electric Infrastructure Security.” That section assigned notable new 
authority to the Department of Energy (DOE) and the Commission, among other 
Federal agencies. Under this new authority, DOE can declare a grid security emer- 
gency and order actions to address it. As I will discuss further below, DOE is also 
to consult with the Commission regarding development of a Strategic Transformer 
Reserve Plan to reduce the threats from physical, cyber, EMP, GMD, severe weath- 
er, and seismic events. The Commission, in consultation with DOE, is to develop 
regulations governing the designation, protection, and appropriate sharing of Crit- 
ical Electric Infrastructure Information. In addition, under the Cybersecurity Act of 
2015 also enacted late last year, Congress directed the Federal Government to share 
and receive cybersecurity threat and mitigation information, while restricting its 
regulatory use, with non-Federal entities including State governments and industry. 

Consistent with these requirements, the Commission established OEIS in late 
2012 to provide a more agile and focused approach to growing cyber and physical 
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security threats. The mission of OEIS is to provide expertise and assistance to the 
Commission, other Federal and State agencies and jurisdictional entities in identi- 
fying, communicating, and seeking comprehensive solutions to significant potential 
cyber and physical security risks to the energy infrastructure under the Commis- 
sion’s jurisdiction. This includes threats from geomagnetic disturbances (GMDs) and 
electromagnetic pulses (EMPs). 

Specific to the subject of this hearing, GMD and EMP events are generated from 
either naturally-occurring or man-made causes. In the case of GMDs, naturally oc- 
curring solar magnetic disturbances periodically disrupt the earth’s magnetic field 
which, in turn, can induce currents on the electric grid that may simultaneously 
damage or destroy key transformers over a large geographic area. Regarding man- 
made events, EMPs can be generated by devices that range from small, portable, 
easily concealed battery-powered units all the way through missiles equipped with 
nuclear warheads. In the case of the former, equipment is readily available that can 
generate localized high-energy bursts designed to disrupt, damage, or destroy elec- 
tronics such as those found in control systems on the electric grid. The EMP gen- 
erated during the detonation of a nuclear device is far more encompassing and gen- 
erates 3 distinct effects, each impacting different types of equipment; a short high- 
energy RF-type burst called El that destroys electronics; a slightly longer burst that 
is similar to lightning termed E2; and a final effect termed E3 that is similar in 
character and effect to GMD targeting the same equipment including key trans- 
formers. Any of these effects can cause voltage problems and instability on the elec- 
tric grid, which can lead to wide-area blackouts. 

In 2001, Congress established a commission to assess and report on the threat 
from EMP. In 2004 and again in 2008, that commission issued reports on these 
threats. One of the key findings in the reports was that a single EMP attack could 
seriously degrade or shut down a large part of the electric power grid. Depending 
upon the attack, significant parts of the electric infrastructure could be “out of serv- 
ice for periods measured in months to a year or more.” It is important to note that 
effective mitigation against solar geomagnetic disturbances and non-nuclear EMP 
weaponry can also provide an effective mitigation against the impacts of a high-alti- 
tude nuclear detonation. 

In order to better understand and quantify the effect of EMP and GMD on the 
power grid, the Commission, DOE, and the Department of Homeland Security 
(DHS) sponsored a study conducted by the Oak Ridge National Laboratory in 2010. 
The results of the study support the general conclusion of prior studies that EMP 
and GMD events pose substantial risk to equipment and operation of the Nation’s 
electric grid and under extreme conditions could result in major long-term electrical 
outages. Unlike EMP attacks that are dependent upon the capability and intent of 
an attacker, GMD disturbances are inevitable with only the timing and magnitude 
subject to variability. The Oak Ridge study assessed a solar storm that occurred in 
May 1921, which has been termed a 1-in-lOO-year event, and applied it to today’s 
electric grid. The study concluded that such a storm could damage or destroy over 
300 bulk power system transformers interrupting service to 130 million people with 
some outages lasting for a period of years. 

To date, a few U.S. entities have taken some initial steps to address EMP on their 
systems, but much work remains. Internationally, the United Kingdom, Norway, 
Sweden, Finland, Germany, South Korea, Japan, Australia, New Zealand, South Af- 
rica, Israel, and Saudi Arabia have GMD and/or EMP programs in place or are in 
the early stages of addressing or examining the impacts of GMD or EMP. The costs 
of these initiatives can vary widely depending on factors such as the threshold of 
protection, the service requirements of the load, the type of equipment that is to be 
protected, and whether the installation is new or a retrofit. 

With these issues and challenges in mind, the Commission has used a two-fold 
approach to help address the GMD and EMP threats, applying both regulatory and 
collaborative actions. 

First, with respect to regulatory actions, the Commission has directed NERC to 
propose 2 reliability standards on GMD. The Commission approved the first of 
NERC’s proposals, a mandatory reliability standard that requires certain entities to 
implement operational procedures to mitigate the effects of GMD events. The Com- 
mission also has issued an order proposing to approve the second of NERC’s pro- 
posals, a reliability standard that would establish requirements for certain entities 
to conduct initial and on-going assessments of the vulnerability of their trans- 
mission systems against a benchmark geomagnetic disturbance. The Commission 
has received comments on its proposed order and held a related technical conference 
in March. The Commission is currently reviewing this record to determine how to 
move forward. 
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The Commission’s regulatory authority with respect to rates also may be relevant 
to addressing these issues. For example, the Commission has issued 2 orders to pro- 
vide clarity on how it will address services provided by Grid Assurance, a company 
recently created by several electric utilities and energy companies. Grid Assurance 
is intended to enhance grid resilience and protect customers from prolonged outages 
by providing electric utilities that subscribe to Grid Assurance with timely access 
to an inventory of emergency spare transmission equipment, including transformers, 
that otherwise can take months or longer to acquire. 

Second, with respect to collaborative actions, the Commission works closely with 
Federal agencies. State agencies, and industry members in many ways. In general, 
such collaboration has included efforts to identify key energy facilities; conduct 
physical and cyber threat briefings, including on GMD and EMP, to industry mem- 
bers; assist with the identification of best practices for mitigation; and cooperate 
with international partners to convey threat and mitigation information as well as 
encourage adoption of best practices for mitigation. 

Some of the Commission’s collaborative actions are relevant to GMD and EMP 
threats. For example, in November 2014, the National Science and Technology 
Council (NSTC) created the Space Weather Operations, Research, and Mitigation 
(SWORM) Task Force to develop high-level strategic goals for enhancing National 
preparedness for a severe space weather event. This Task Force is co-chaired by 
members from the Office of Science and Technology Policy, DHS, and the National 
Oceanic and Atmospheric Administration. The Commission has participated in the 
SWORM Task Force’s efforts from its inception. 

In addition, as required by the FAST Act, DOE, in consultation with the Commis- 
sion and others, is developing a plan to establish a Strategic Transformer Reserve. 
The Strategic Transformer Reserve Plan is to identify the sufficient number, type, 
cost, and location of equipment needed to temporarily replace critically-damaged 
large power transformers and substations that are part of the critical electric infra- 
structure or that serve defense and military installations. Specific to the subject of 
today’s hearing, the Strategic Transformer Reserve Plan will decrease 
vulnerabilities related to physical and cyber threats, including both EMP and GMD. 
The Strategic Transformer Reserve Plan is not limited to transformers, but is also 
to include other critical electric grid equipment as necessary to provide or restore 
sufficient resiliency. 

The Commission’s efforts to date are consistent with the recommendations of the 
Government Accountability Office’s recently-released report on electromagnetic risks 
to the electric grid. I believe that building on previous collaboration among the Com- 
mission and other Federal agencies can enhance our collective response in address- 
ing electromagnetic threats to the electric grid in the United States. 

Thank you again for the opportunity to testify today. I would be happy to answer 
any questions you may have. 

Mr. Perry. Thank you, Mr. McClelland. 

The Chair now recognizes Mr. Freed for his statement. 

STATEMENT OF JUDSON M. FREED, DIRECTOR, EMERGENCY 

MANAGEMENT AND HOMELAND SECURITY, RAMSEY COUN- 
TY, MINNESOTA, ON BEHALF OF THE NATIONAL ASSOCIA- 
TION OF COUNTIES 

Mr. Freed. Thank you, Chairman Perry, Ranking Member Wat- 
son Coleman, and Members of the subcommittee, for this oppor- 
tunity to testify today on Federal efforts addressing electro- 
magnetic risks. 

My name is Judson Freed, and I serve as director of emergency 
management and homeland security in Ramsey County, Minnesota. 
I also serve the justice and public safety committee of the National 
Association of Counties, which represents all of America’s 3,069 
counties, parishes, and boroughs. 

As a large urban county located in the northern Midwest, 
Ramsey County faces perennial threats ranging from tornadoes 
and ice storms to train derailments and multi-location terrorist at- 
tacks. In my role as the county’s emergency management director 
and homeland security director, I work to protect our local commu- 
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nities and their residents and their structures from the on-going 
threats posed by these and other disasters. 

Although all parts of government play a role in disasters, coun- 
ties across the Nation often serve as the first line of defense before 
and after disaster strikes, and we are responsible for helping our 
communities recover in the aftermath. Any potential failing of our 
Nation’s power grid and the cascading impacts that would follow 
would heavily impact local governments and require an immediate 
on-the-ground response by county emergency managers and a 
range of other local officials. 

With that said, Mr. Chairman, I respectfully submit 3 principles 
for your consideration as you assess Federal efforts to mitigate 
against electromagnetic risks. 

First, the impact of Federal policy changes on local government 
should be closely considered, particularly when it comes to matters 
of emergency management. Local governments respond to the Fed- 
eral Government’s actions not just in our role as intergovernmental 
partners with Federal agencies but also because our constituents 
demand that their local leaders keep pace with the Federal Govern- 
ment’s priorities and initiatives. 

Federal policy changes related to electromagnetic risks would im- 
pact local emergency management efforts. Consider the Critical In- 
frastructure Protection Act. The bill would require in part that the 
DHS Secretary conduct outreach to educate emergency response 
providers at all levels of government of the threat of electro- 
magnetic pulse events. Requirements like this can accumulate 
quickly and have the potential to disrupt the on-going process of 
local emergency management planning and coordination. 

Second, electromagnetic risks should be viewed in the context of 
the whole wide variety of threats faced by our Nation and its local 
communities. Due to changes in things like weather patterns and 
population growth, especially in densely-populated areas like 
Ramsey County, our Nation is facing an arguably unprecedented 
number of threats and disasters. According to NACo’s analysis of 
data made available by FEMA, 92 percent of counties across the 
Nation have had at least 1 Presidential disaster declaration in the 
last 10 years. 

Further, due to globalization and advances in technology that 
have made us more interconnected than ever before, communities 
across the country also face novel cybersecurity threats from within 
and outside of the United States. We urge you to consider electro- 
magnetic threats in the context of the full range of risks faced by 
our communities. 

Last, emergency management resources, both fiscal and adminis- 
trative, are finite at all levels of government and should be allo- 
cated based on holistic and pragmatic risk assessment. Diverting 
limited resources from highly probable threats will make our Na- 
tion less prepared for the risks and disasters that have proven to 
be perennial visitors to all of our communities. 

In Ramsey County, we have worked hard to ensure that our 
emergency management decisions and policies are based on prag- 
matic and scientific risk assessment that takes into consideration 
both the potential consequences and the likelihood of various 
threats. This method of emergency management risk assessment is 
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one that was promoted in the 2014 Homeland Security QHSR and 
is widely accepted as a local best practice in counties Nation-wide. 

That said, we are by no means inattentive to the threats posed 
to our power grids. In my county, for example, we monitor space 
weather and provide weekly reports to our local public safety part- 
ners and leadership. We monitor the status of our region’s power 
grid and include our utility providers in our oversight and planning 
workgroups. 

We assess transmission line protection in light of severe weather 
and flooding, as well as geomagnetic incidents, and large-scale 
power failures would present significant and cascading challenges 
to our emergency response systems. We consider these risks in our 
disaster response and coordination efforts, and we base them on 
our broader risk assessment strategies and work to mitigate these 
risks at every opportunity. 

In closing, I would like to thank you again for the opportunity 
to provide the local perspective in this important conversation on 
Federal efforts to address electromagnetic risks, and I will welcome 
any questions you may have. 

[The prepared statement of Mr. Freed follows:] 

Prepared Statement of Judson M. Freed 
May 17, 2016 

Thank you Chairman Perry, Ranking Member Watson Coleman, and Members of 
the Subcommittee on Oversight and Management Efficiency for this opportunity to 
testify. 

My name is Judson Freed and I have served as director of emergency manage- 
ment and homeland security in Ramsey County, Minnesota since 2003. I am also 
vice chair of the Emergency Management Subcommittee of the National Association 
of Counties’ Justice and Public Safety Policy Steering Committee. 

ABOUT NACO 

NACo is the only national organization that represents county governments in the 
United States, including Alaska’s boroughs and Louisiana’s parishes. Founded in 
1935, NACo assists America’s 3,069 counties in pursuing excellence in public service 
to produce healthy, vibrant, safe, and resilient communities. 

ABOUT AMERICA’S COUNTIES 

Counties are highly diverse, not only in my State of Minnesota, but across the 
Nation, and vary immensely in natural resources, social and political systems, cul- 
tural, economic and structural circumstances, and public health and environmental 
responsibilities. If you’ve seen 1 county, you’ve seen 1 county, and there are 3,068 
more to go. 

Counties also often serve as our Nation’s first line of defense before and after dis- 
asters strike. While State statutes and organizational structures vary, local emer- 
gency management responsibilities are most commonly vested in county govern- 
ments. Many counties, including Ramsey County, are required to maintain an emer- 
gency management agency to coordinate all activities related to emergency and dis- 
aster situations. These responsibilities go well beyond the functions of public safety 
and emergency services and involve a community-wide effort before, during, and 
after a disaster or emergency incident occurs. Emergency managers are charged 
with preparing their communities for disasters so that when these events inevitably 
take place, their toll on our residents, homes, and public and private structures is 
minimized. Following a disaster, local emergency managers, on behalf of their elect- 
ed officials, work to mitigate damage and save lives. In the aftermath of disasters, 
we coordinate and help fund clean-up, recovery, and rebuilding so that our residents 
can return to their lives as quickly as possible. 
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ABOUT RAMSEY COUNTY, MINNESOTA 

Ramsey County is a large, fully urban county located near Minnesota’s border 
with Wisconsin, and with a population of more than 550,000, is the second-most 
populous county in Minnesota. It is also the smallest county in Minnesota, and with 
its large population, among the most densely populated counties in the Nation. St. 
Paul, the capital of Minnesota, is our county seat. 

As a large, urban county located in the northern Midwest, Ramsey County faces 
perennial threats ranging from tornadoes and ice storms to train derailments and 
multi-location terrorist attacks. In my role as the county’s director of emergency 
management and homeland security, I work to protect our local communities and 
their residents and structures from the on-going threats posed by these disasters. 

FEDERAL EFFORTS TO ADDRESS ELECTROMAGNETIC RISKS: THE LOCAL PERSPECTIVE 

Counties are not merely stakeholders in this conversation, but a pivotal part of 
the Federal-State-local partnership of governments that together share the responsi- 
bility of protecting our Nation and its residents from disasters. Any potential failing 
of our Nation’s power grid — and the cascading impacts that would follow — would re- 
quire an immediate on-the-ground response by county emergency managers, law en- 
forcement, firefighters, EMS, 9-1-1 call centers, public health officials, and public 
records and code inspectors. As such, counties appreciate the potential threat posed 
by electromagnetic risks and commend the subcommittee for convening this hearing 
to assess Federal efforts to address these risks. 

Mr. Chairman, I will focus my remarks today on 3 principles that we believe the 
subcommittee should observe as you assess Federal efforts to mitigate against elec- 
tromagnetic risks: 

• First, the potential impact of Federal policy changes on local governments 
should be closely considered, particularly when it comes to emergency manage- 
ment. Counties are charged with protecting local communities from threats both 
natural and man-made, and Federal actions that change National priorities can 
unintentionally compromise counties’ ability to carry out this responsibility and 
ultimately make our Nation less safe. 

• Second, electromagnetic risks should be viewed in the context of the wide vari- 
ety of threats faced by our Nation and its local communities. We must prepare 
for an arguably unprecedented variety of risks — from hurricanes and tornadoes 
to terrorism and cybersecurity threats — and should not lose sight of this fact as 
we assess electromagnetic threats. 

• Third, emergency management resources — both fiscal and administrative — are 
finite at all levels of government and should be allocated based on holistic and 
pragmatic risk assessment. Diverting limited resources from highly-probable 
threats will make our Nation less prepared for the risks and disasters that have 
proven to be perennial visitors to our communities. 

By observing these principles — which are elaborated upon below — as you assess 
Federal efforts to mitigate against electromagnetic risks, the subcommittee can less- 
en the likelihood that policy changes made leave our country more prepared for one 
particular threat while decreasing our overall preparedness for the many different 
risks that face our local communities at any given time. 

The potential impact of Federal policy changes on local governments should be 
closely considered, particularly when it comes to emergency management.. — ^As out- 
lined in the opening section, counties play a critical role in protecting our local com- 
munities from natural and man-made threats. It has been said that “disasters are 
local,” and I can attest that a well-organized local emergency management structure 
is crucial to disaster preparation, mitigation, and recovery efforts. 

But many factors affect a local emergency manager’s ability to perform his or her 
functions in a streamlined and efficient manner. De-prioritization of emergency 
management efforts at the county level or insufficient support for emergency man- 
agement from the State government are just 2 examples. Another example — most 
relevant to the conversation at hand — involves rapidly-changing priorities and poli- 
cies at the Federal level. Counties respond to the Federal Government’s actions, not 
just in our role as intergovernmental partners working with our Federal counter- 
parts towards the shared goal of serving American residents, but also because our 
constituents demand that their local leaders keep pace with the Federal Govern- 
ment’s priorities and initiatives. 

Policy changes related to electromagnetic risks would be no different in this re- 
gard. Consider the Critical Infrastructure Protection Act (H.R. 1073), which was 
passed by the House late last year. The bill would require, in part, that the Sec- 
retary of the U.S. Department of Homeland Security “conduct outreach to 
educate . . . emergency response providers at all levels of government of the threat 
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of [electromagnetic pulse] events.” Imposing Federal requirements like this has the 
potential to disrupt the on-going process of local emergency management planning 
and coordination and could undermine our ability to preserve the safety of our com- 
munities. We urge Members to consider the cumulative impact of such requirements 
as Congress works to enact this legislation. 

Electromagnetic risks should be viewed in the context of the wide variety of threats 
faced by our Nation and its local communities. — Due to changes in weather patterns 
and population growth — especially in densely-populated areas like Ramsey County — 
our Nation is facing an arguably unprecedented number of threats and disasters. 
We must not lose sight of these various threats as we take on the work of assessing 
the risks posed by electromagnetic pulses and space weather events. 

According to NACo’s analysis of data made available by the Federal Emergency 
Management Agency (FEMA), 92 percent of counties across the Nation have had at 
least one Presidential disaster declaration in the past 10 years. Overall, these dis- 
aster declarations are happening at unprecedented rates, and each disaster seems 
costlier than the last. Due to globalization and advances in technology that have 
made us more interconnected than ever before, communities across the country also 
face novel cybersecurity threats from within and outside the United States. 

While we appreciate the importance of protecting our Nation against a potentially 
devastating failure of our power grids resulting from an electromagnetic event, we 
urge you to consider this threat in the context of all of the risks and threats that 
we have been entrusted to protect our communities against, especially at a time 
when the full range of threats seems to be increasing year after year. 

Emergency management resources — both fiscal and administrative — are finite at 
all levels of government and should be allocated based on holistic and pragmatic 
risk-assessment. — As disasters increase in both frequency and cost, we must be prag- 
matic in resource allocation, so that our limited emergency management resources 
go as far as possible in preserving lives, homes, and public and private structures 
in our local communities. Rather than creating new priorities or costly mandates, 
we urge you to view electromagnetic risks as one element in the portfolio of major 
risks we face. 

In Ramsey County, we have worked hard to ensure that our emergency manage- 
ment decisions and policies are based on pragmatic risk assessment that takes into 
consideration both the likelihood and potential consequences of various threats. This 
method of emergency management is one that was promoted in the United States. 
Department of Homeland Security’s 2014 Quadrennial Homeland Security Review, 
and is widely accepted as a local best practice in counties throughout the country. 
Through this sort of risk assessment, we aim to make resource allocation decisions 
that will best protect our communities from threats and disasters. While low-pri- 
ority events like electromagnetic pulses may be deprioritized in this way — and while 
we appreciate that these events are not unprecedented — we nonetheless believe that 
given our finite resources, we can best protect our residents, homes, and public and 
private structures through this manner of risk assessment. 

That said, we are by no means inattentive to the threats posed to our power grids. 
We monitor space weather reports and provide weekly reports to our public safety 
partners and leadership; we monitor the status of our region’s power grid and in- 
clude our utility providers in our oversight and planning workgroups. We assess 
transmission line protection in light of severe weather and flooding — as well as geo- 
magnetic incidents. Whether through space weather, terrorist threat, or an ice 
storm or hurricane, large-scale power failures would present significant and cas- 
cading challenges to our emergency response systems, and we consider these risks 
in our disaster response and coordination efforts, and based on our broader risk-as- 
sessment strategies, work to mitigate these risks at every opportunity. 

CLOSING 

Thank you again Chairman Perry, Ranking Member Watson Coleman, and Mem- 
bers of the subcommittee for this opportunity to provide the local perspective in this 
important conversation on Federal efforts to address electromagnetic risks. 

Mr. Perry. Thank you, Mr. Freed. 

The Chair now recognizes himself for a few minutes of ques- 
tioning. I am going to start out with Mr. McClelland from FERC. 

Sir, given that FERC liaisons with industry frequently, please 
provide the subcommittee with the industry perspective as you see 
it on the threat posed by EMP. For example, does industry feel 
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they are well-prepared for an EMP event? Or do you think they 
are? 

Mr. McClelland. So that is a tough question to start. 

At this point, industry has been requesting better intelligence re- 
garding the probability of an EMP strike. There isn’t much doubt 
as far as the science behind the strike, what could happen to the 
power grid in the event that a strike occurs. 

The question from industry’s perspective is, how do we rank this 
risk? How do we prioritize this assignment from the Eederal Gov- 
ernment? What is the probability that we will see a nation-state at- 
tack, a high-altitude electromagnetic pulse from a nuclear war- 
head? 

To follow up, because of that, there’s been very little done by in- 
dustry to prepare for this attack. 

Mr. Perry. Okay. Thank you. 

I am going to move on to Mr. Currie. 

How has the lack of a lead DHS office or official responsible for 
EMP impacted DHS’s efforts? Has this led to inefficiencies or dupli- 
cation? Can you enumerate? 

Mr. Currie. Sure. 

We didn’t actually find any instances of duplication across the 
departments, but what we said in our report was that, certainly, 
because of the lack of a coordination lead, there is higher risk of 
potential overlap, fragmentation, and duplication. 

I don’t think we really know, because there hasn’t been a cross- 
departmental coordination effort to look at all the research that 
has been done, all the testing and development that has been done 
as part of a holistic plan. So we really don’t know. 

But the lack of a lead, I think, has just led to a lot of confusion, 
especially in industry, as well, about who is responsible for this 
and what they are supposed to be doing to address it. Mr. 
McClelland hit that point. It is, who are we supposed to go to, to 
understand these risks, and who are we supposed to go to to under- 
stand the research behind how we protect against these risks? 

Mr. Perry. But you said that you don’t know that it has led to 
any inefficiency or duplication? I just want to make sure I under- 
stand you. 

Mr. Currie. Yeah, we did not find — we looked across all the De- 
partmental efforts — and, actually, I just want to say that, when 
you go talk to the Department about these issues, they don’t have 
a list of EMP or electromagnetic actions. What we did is we looked 
across all the actions they were taking to protect critical infrastruc- 
ture for the energy sector and we said, well, how does this apply 
to EMP and the EMP Commission? So we actually did that work. 

We didn’t find duplication of effort, but what we found is little 
coordination between the departments of those efforts. 

Mr. Perry. Okay. 

You are still, obviously, recommending that there should be a 
lead, one individual that is the go-to person that is coordinating the 
effort where the buck stops, right? 

Mr. Currie. Absolutely. Within DHS, it is critical, I think, that 
there be a stop within DHS. We actually found in DOE and FERC 
that it was pretty clear who was responsible for this, just not with- 
in DHS. 
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Mr. Perry. Okay. Thank you. 

Mr. Wales, an EMP attack can be carried out by detonating a nu- 
clear device above the atmosphere or through the use of EMP 
weapons. If you know, what nations and/or hostile nation-states or 
actors currently have the capability to launch such an attack? 
What steps is DHS taking to specifically protect critical infrastruc- 
ture from an EMP attack? 

Mr. Wales. Sure. Thank you, sir. 

So any country that has a nuclear capability would have the ca- 
pacity to generate an electromagnetic pulse from the explosion of 
a nuclear weapon. 

With that being said, the Department relies heavily on the exper- 
tise of the broader U.S. intelligence community to provide us infor- 
mation on the capabilities and intent of our potential adversaries. 
In an open hearing, I don’t think I am comfortable sharing the kind 
of information that they have provided to us in the past. 

But I will say that we are guided by the consensus view of the 
intelligence community as enumerated in the report released in 
2014 on the threat posed by a high-altitude EMP event against the 
United States over the next 5 years. 

Mr. Perry. Let me just ask you, the steps that DHS is taking 
specifically to protect critical infrastructure, even if they are just 
recommendations for best practices, have you seen them? Do they 
seem adequate and appropriate to you? 

Mr. Wales. The question of whether the grid can withstand a 
large electromagnetic pulse today, I mean, clearly the answer is no. 
We are not prepared for that type of significant attack. 

I think that being said, industry does work to try to improve its 
overall level of resilience. The Department has, I think as I out- 
lined in my testimony, provided information to help them make 
better decisions. Obviously, as outlined by GAO, there is more to 
be done, and we are committed to executing on GAO’s rec- 
ommendations. We think that will further help industry be pre- 
pared. 

But, ultimately, given the current authority at the Department 
and DOE and elsewhere, the ultimate burden for preparing for that 
type of event on the systems that operate our grid are going to be 
the utilities themselves. The work that we do is to help them be 
as prepared as they can be by providing them the kind of informa- 
tion that can help them make better decisions. 

Mr. Perry. Okay. Thank you. 

My time has expired. The Chair now recognizes the gentlelady, 
Mrs. Watson Coleman. 

Mrs. Watson Coleman. Thank you very much, Mr. Chairman. 

Mr. Currie, you indicated that you think that Homeland Security 
should be sort-of the coordinating agent, there should be someone 
there that is the go-to person for this whole issue. What component 
do you think should have that responsibility? 

Mr. Currie. So we didn’t actually designate in the report who we 
thought it should be. 

I will tell you that, in law and Presidential Directive, it is pretty 
clear that NPPD, Mr. Wales’ parent organization, is responsible for 
critical infrastructure protection. 
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That was one of the key points in our report, is even though they 
didn’t have to implement the Commission’s recommendations — and, 
by the way, one of the Commission’s recommendations was to es- 
tablish roles and responsibilities and make that clear — they are al- 
ready responsible for doing that under the National Infrastructure 
Protection Plan. So it would likely be in NPPD. 

Mrs. Watson Coleman. Okay. Thank you. 

Mr. Freed, as emergency management director, you are aware of 
a range of natural occurrences and threats impacting the home- 
land, in particular in your county. Please state the threats, the 
dangers, or the occurrences that are of specific concern in your dis- 
trict. Share with us, please, how does the EMP risk fit into this in 
the priority of areas? 

Mr. Freed. Thank you for that question. 

Under the methodology that DHS has worked to help us go for- 
ward on our risk assessment, we take a look at the various bad 
things that can happen in our county, their likelihood and impact, 
our capabilities to cope with those, and then basically look at the 
gaps between capability and worst case. We concentrate on worst- 
case, most-plausible events, and then go forward from there to 
kind-of develop the things that keep us up at night. 

We don’t actually rank them, but there is sort-of the big group 
that does. Among that big group, of course, in the upper Midwest, 
you can imagine, tornados; you can imagine, winter storms. But 
prolonged power failure, particularly during the wintertime in the 
upper Midwest, is 1 of our 3 very big events. There is also haz- 
ardous materials incidents and terrorist attack are things that in 
urban areas such as ours we worry about. 

The impacts of a power failure, however, are the impacts of a 
power failure whether it is caused by a high-altitude EMP, a geo- 
magnetic disturbance, an ice storm bringing down the power lines. 
If there is a surge that destroys one of those EHV transformers, 
we are going to rely on the transformer stockpile or some other 
method. 

So I certainly don’t want to discount the absolute importance of 
the EMP and GMD preparedness; I just want to ask the committee 
to keep in mind that, you know, we need to address these things 
holistically. Preparing to cope with the threat to an EHV trans- 
former, we can do that without increasing rules, regulations, train- 
ing requirements for local government officials to make them all 
experts at El, E2, and E3 effects of HEMP. I mean, that is sort- 
of where we look at it, is more holistically. That is, you know, our 
ask to the committee to consider. 

Mrs. Watson Coleman. So do you have a relationship with the 
Department of Homeland Security in sort-of discussing and devel- 
oping this, sort-of, risk-based management? Tell me to what degree 
do you interact with the Department. 

Mr. Freed. Much better in recent years than in past. 

I teach — I am a risk geek 

Mrs. Watson Coleman. I am sorry, I didn’t hear that. 

Mr. Freed. I am a risk geek. I teach risk at the collegiate level, 
undergraduate collegiate level. Very often, the assessment of risk 
is extremely superficial and inaccurate. The vulnerability-times- 
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consequences measure — that is TVC — it is not an effective way at 
looking at risk. 

Through programs like the Urban Areas Security Initiative and 
what is called the THIRA requirement, which is a Threat and Haz- 
ard Identification and Risk Assessment, we have started to now. 
Nation-wide, adopt some of the risk-geekiness application of meas- 
urement. So instead of, “Well, that would be bad,” we now look at 
why it would be bad, and what are potential causes? 

The problem comes that we can’t prevent all of those causes, but 
we can mitigate widely against those events. Wherever possible, 
mitigating in a manner that protects us against multiple events is 
sort-of the key to doing this in an effective manner and an efficient 
manner as well. 

So that is what we try and do, is we try and take a look at those 
gaps and figure, if we do this training or buy this piece of equip- 
ment or implement this policy, procedure, or plan, can we cope 
with a lot of things or are we only protecting against one possi- 
bility? 

Mrs. Watson Coleman. Thank you, Mr. Freed. 

My time is up. I yield back. 

Mr. Perry. The Chair thanks the gentlelady. 

The Chair now recognizes the gentleman from Georgia, Mr. 
Loudermilk. 

Mr. Loudermilk. Thank you, Mr. Chairman. 

Thank you to all the witnesses being here today. It is a very im- 
portant subject and one that, even on the Science, Space, and Tech- 
nology Committee, that we have addressed some of these. 

I do have some more technical questions. 

Mr. Wales, when we talk about the potential of an EMP attack, 
what specific damage would be done to power generation? Can you 
address that? Or anyone? What I am looking at is what damage 
would be done to generation versus the distribution system? 

Mr. Wales. In an EMP event, because EMP generates multiple 
types of waves that will affect different systems in different ways, 
we would expect disruption to both generation and distribution sys- 
tems — generation, transmission, and distribution systems. Any sys- 
tem that has industrial control systems could be affected by some 
parts of the EMP event. The transmission lines could be affected 
by others. 

The scale will obviously depend upon the unique type of what is 
generating the EMP pulse, where it is, how it is detonated — 
ground, air, et cetera. So there are a lot of factors. 

In part, this is why we have launched this new project with the 
Department of Energy to better bound what types of EMP events 
are going to potentially create the most amount of damage to the 
power systems and which ones are likely to generate less impacts. 

Obviously, the thing that we are concerned about most would be 
permanent damage to large equipment like the high-voltage trans- 
formers that have much longer lead times for replacement and are 
often built for specific purposes. 

Mr. Loudermilk. Okay. That is kind-of what I was getting at. 
I have heard several of you talk about these transformers, and 
stockpiling these transformers. But in case of an EMP attack on 
the United States, is predominantly the damage to the power gen- 
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eration going to be done in the microprocessors, the control sys- 
tems? Or are we actually looking at the generators itself being 
fried, for lack of a more technical term? 

Mr. Wales. I think the issue would be more of a concern with 
the transmission substation being 

Mr. Loudermilk. Okay. So hydroelectric dams, coal power facili- 
ties would still be able to generate power, it is just they wouldn’t 
be able to 

Mr. Wales. Possibly. Those would also be affected by the loss of 
their control systems from microprocessor disruptions from an 
EMP event. 

But I think the — we have a lot more generation in the country. 
We have a lot of excess generation that can be spooled up when we 
need it, and a lot of it is not on-line at any given moment. There- 
fore, the bigger concern is the transmission disruptions, the sub- 
stations that could be damaged through an EMP. 

Mr. Loudermilk. Okay. 

Then my concern is around the protection of those replacement 
parts, per se. Is there a method of protecting — are we protecting, 
let’s say, the transformers that we talked about? Stockpiling the 
transformers? What type of protection do we have to ensure that 
even those would not be damaged? 

Mr. Wales. So there is a small amount of extra transformers 
that are maintained by industry, and they have a program to share 
those in the midst of a disruption. That is obviously meant for 
smaller-scale disruptions. They can get those in place. At times, 
utilities will also maintain an extra spare on site that may not be 
activated at any given moment that could be brought back up on 
line. 

But this is also why the Department invested in this recovery 
transformer project through our Science and Technology Direc- 
torate that actually piloted a modular transformer that can be 
moved in and gotten up and running more quickly than traditional 
transformers. That project successfully demonstrated that that 
could be done with the Houston CenterPoint utility back in 2014. 
That was a project that was worked jointly with industry. So that 
demonstration project is now available should industry want to 
purchase transformers like those that can be brought up on-line 
very quickly and more 

Mr. Loudermilk. Those could be protected if they are not ac- 
tively on the grid? 

Mr. Wales. Correct. Generally, if a system is not in use, it has 
a much higher degree of surviving an electromagnetic pulse. 

Mr. Loudermilk. Okay. 

You mentioned the 1920s geomagnetic disturbance. Would some- 
thing like that, if it were to happen today, have a world-wide ef- 
fect? Or would it be more limited to, what position the Earth was 
in, those that were facing the sun at the moment it happened? 

Mr. Wales. There are going to be some effects that may be glob- 
al. So, as it scintillates satellites, it could affect multiple parts of 
our constellations. Depending on the length and intensity of a geo- 
magnetic event, it could have wider-scale impacts. 

In general, I think the specifics of a geomagnetic event are going 
to determine the effect it has both on the country and any of our 
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neighbors. In general, we assume that the higher latitudes are 
going to be more directly affected than lower latitudes, but it also 
will depend upon things like the geology of those areas, how much 
they will carry geomagnetic effects. 

So these are some of the factors that need to be evaluated when 
trying to understand the impacts of a geomagnetic event on a coun- 
try. 

Mr. Loudermilk. Okay. Thank you. 

Mr. Chairman, may I just add in closing that a Congressional in- 
vestigation on the attack of Pearl Harbor determined that the Gov- 
ernment felt that the Japanese attacking Pearl Harbor was pos- 
sible but not probable. The same with the 9/11 attacks, that the 
terrorists hijacking aircraft and flying them into Government build- 
ings and buildings in the United States was possible but was not 
probable. 

Mr. Perry. The Chair thanks the gentleman. 

The Chair now recognizes the gentlelady from California, Mrs. 
Torres. 

Mrs. Torres. Thank you, Mr. Chairman. 

I have a question for Director McClelland. 

National electrical systems for countries across the globe are 
structured in many different ways. Mitigation for geomagnetic dis- 
turbances will have to be tailored to specific countries’ needs. 

Are you aware of any plans to propose international standards, 
given that there are so many different and individualized systems 
that will need specialized mitigation? 

Who would oversee such an effort? I am trying to understand 
this issue. Is this an issue unique to the United States, or is this 
an issue that we should be working with our partners across the 
world? 

Mr. McClelland. Thank you for the question. 

Currently, there are many independent initiatives internation- 
ally. So the United Kingdom, Norway, Quebec have all initiated, 
not to mention other countries as named in the — there is a Con- 
gressional research report for Congress in, I will say, March 26, 
2008, that specifically mentions mitigation efforts in, for instance, 
Russia from both GMD and EMP. 

So, independently, these nations are moving forward. They are 
protecting the most critical — they are identifying and prioritizing 
infrastructure, energy infrastructure, to protect their population, 
and they are moving forward with mitigation efforts. 

To date, the United States has coordinated and has shared infor- 
mation with other nations, but there is no international standards 
development and nothing compulsory that is being shared across 
the nations. But, as I said, the United States is falling behind. 
Other nations are moving ahead for mitigation on geomagnetic dis- 
turbances and, in some cases, electromagnetic pulse. 

Mrs. Torres. So, back to my question, who do you think should 
oversee those efforts? Is that something that the United States 
solely should continue to pursue? Or is that something that should 
fall under U.N. -specific standards? Should there be a specific com- 
mission related to this issue? How broad is it and how much of a 
global impact, given our trade agreements and all of that that 
could impact our communities across the world? 
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Mr. McClelland. I do think international collaboration will be 
important. I think that the large storms — 1859, 1921 — they oc- 
curred over a period of days, so the entire Earth was affected by 
these storms, but no one had the interconnectedness of the power 
grids that they have today and, arguably, the vulnerability of the 
equipment. 

Traditionally, it has not been FERC. FERC is not an agency that 
works across those lines internationally. It would be the Depart- 
ment of Energy and the Department of Homeland Security. So I 
would defer to my colleague from the Department of Homeland Se- 
curity to better describe what could be done internationally. 

Mr. Wales. DHS works on a number of issues collaboratively 
with international partners related to terrorism, cyber threats. I 
don’t think in any of those are we attempting to organize the inter- 
national community in terms of a leadership role in taking certain 
action. But I think, as Joe indicated, our goal is to build collabo- 
rative ties with those countries, share information, and to make 
sure that, to the extent possible, we are implementing good, con- 
sistent actions. 

I would say it is a little bit different in the case of Canada, where 
we have, obviously, a shared electric power grid. There is far more 
collaboration there in attempting to implement pretty joint activi- 
ties associated with power grid security and resilience. 

Mrs. Torres. Okay. Thank you. 

Also, the electric grid doesn’t produce energy out of thin air. We 
all know that the electric sector is highly dependent on tele- 
communications, especially fuel supply and delivery infrastructure. 
These key independencies must be identified, understood, and 
prioritized. 

How would you prioritize fuel supply and delivery security as op- 
posed to other infrastructure priorities? I don’t know if Mr. 
McClelland could answer that or if that would be 

Mr. Wales. I will help out Joe here. 

Mr. McClelland. Thank you. 

Mr. Wales. I don’t know that you can segment out some of those 
critical dependencies and interdependencies amongst infrastructure 
such as power generation, natural gas/petroleum movement, you 
know, communications, transportation. In many cases, you need all 
of them working together to successfully deliver the critical services 
that they provide to the American people, our economy, and our 
way of life. 

In many cases, when we are looking at the aftermath of a major 
disruption or major disaster, a Hurricane Sandy, we are trying to 
figure out how best to get most of those capabilities up together so 
they can be mutually reinforcing and allow the services to continue 
flowing. 

But I think the ones that you named are those kind of core set 
of lifeline services that we need and that we would prioritize in the 
aftermath of any type of disruption or for protection in prepared- 
ness activities. 

Mrs. Torres. Thank you, Mr. Chairman. I am out of time. 

Mr. Perry. The Chair thanks the gentlelady. 

The Chair now recognizes the gentleman from Georgia, Mr. Car- 
ter. 
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Mr. Carter. Thank you, Mr. Chairman. 

Thank each being of you for being here. This is a very important 
subject, something that we are obviously all concerned about. 

Mr. Wales, I will start with you. In response to the GAO’s find- 
ings, DHS has responded many times that it has not taken the 
EMP threat seriously. Can you explain to me why it is a low pri- 
ority? It would seem to me that this should be a top priority. Am 
I missing something here? 

Mr. Wales. I would not characterize DHS’s position that we are 
treating this as a low priority. As I think I have outlined in my 
statement, there is activity occurring across DHS that in some 
cases is directly focused on addressing EMP-related threats and 
their risks. 

When you look at the activity that DHS co-chaired with the Of- 
fice of Science and Technology Policy at the White House that de- 
veloped a Space Weather Action Plan that applies across the inter- 
agency, I think that demonstrates that the Department is ex- 
tremely focused on doing what it can to help improve the security 
and resilience against that issue. 

But I would also 

Mr. Carter. Well, now that you mention that, one of the findings 
in the report is there was no central entity within DHS that was 
concentrating on that. Have you identified a central entity yet? 

Mr. Wales. So, in response to the GAO recommendations, the 
Department of Homeland Security identified its Office of Policy — 
the Cyber Infrastructure Resilience Policy Office will serve as the 
lead for coordinating DHS actions on EMP. 

That being said, the complexity of the issue means that the var- 
ious components, the operational components, of the Department 
need to bring to bear its specialized skills and execution to address 
this issue. The work that FEMA does is not going to be done by 
other parts of the Department. The work that S&T does to sponsor 
research and develop prototypes is not going to be done by other 
parts of the Department. The work that we do in NPPD to work 
with industry, conduct studies, that is not going to be done by 
other parts of the Department. Policy’s job is to make sure that all 
of our efforts are aligned and moving in a common direction. 

I will just say one other thing on the, kind-of, initial question, 
and that is, as I think has been outlined by a number of people 
today, we have to view EMP in terms of the broader array of risks 
that we face as a country in our critical infrastructure. When we 
devote resources to one topic, that means that we are sacrificing 
focus and attention on other topics. 

Mr. Carter. We understand that. We certainly understand that. 
But, again, it just seems that the Department is making this a low 
priority when it would appear to us that it needs to be a high pri- 
ority and a top priority. 

Let me ask Mr. McClelland. 

Mr. McClelland, what changes would you suggest to be made im- 
mediately? I mean, if we are going to be better prepared, what do 
we need to do immediately, not only for perhaps a man-made but 
even a natural disaster? 

Mr. McClelland. The first order of business would be to 
prioritize the assets. I know that DHS has done work in that area. 
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With 55,000 substations across the United States, I think the argu- 
ment legitimately back from industry would be, “We can’t protect 
every one of these facilities from EMP. It is simply too difficult and 
it is too expensive.” 

However, if the assets were prioritized around functionality — for 
instance, what do you need to provide skeletal service to major 
urban areas? What facilities does DOD absolutely have to have in 
service in order to remain mission-ready? What might be critical 
infrastructure service, such as off-site service to nuclear power 
plants? Identify those criticalities. It won’t be near 55,000 stations. 
It may just end up being a few hundred stations. 

Then from there, provide threat briefings and critical intelligence 
to the owners and operators of those facilities, because the Govern- 
ment can’t do it without them. We don’t own the facilities, and we 
have no authority to compel them to take action. 

Mr. Carter. Understood. Understood. 

Mr. McClelland. Provide intelligence, and then provide cost re- 
covery as well as best practices to 

Mr. Carter. Okay. 

Mr. Freed, best practices. Are there any best practices out there? 

Mr. Freed. Best practices specific to protection against an elec- 
tromagnetic incident? 

Mr. Carter. Protection and response to a problem. 

Mr. Freed. The short answer is not really, not that has been pro- 
mulgated down to us at the local level, but — not specifically, I 
guess, rather than not really. What there are best practices are in 
exactly what Mr. McClelland was saying, which is prioritizing — we 
refer to it as CIKR, Critical Infrastructure and Key Resources — 
prioritizing what is energized by which power substation; how are 
things transmitted? Then our mitigation efforts are also — there are 
best practices for that, the problem being that a lot of those repairs 
or those mitigation efforts are extremely, extremely expensive and 
time-consuming. For instance, if you bury a transmission line and 
then something happens to it, the cost of fixing it is significantly 
greater. So the private industries kind-of have to weigh the chances 
of that transmission line failing for some reason versus the cost of 
fixing it when it does. 

Mr. Carter. So there are things that counties and municipalities 
can be doing to prepare for this? 

Mr. Freed. There are things that we are currently planning 
around. We do not own those transmission lines either. So I live 
in an area that gets ice storms and severe summer storms and 
floods on a regular basis. That has direct impact on our power 
transmission systems. Working on ways to mitigate against those 
in general and specifically protecting those power lines is some- 
thing we can and do. 

Mr. Carter. Thank you. Just one last point, Mr. Wales. I hope 
the Department is talang this seriously and considers this a top 
priority because I certainly think the impression you get and the 
message you get from this panel today is that we are taking it very 
seriously. 

Thank you, Mr. Chairman. I yield back. 

Mr. Perry. The Chair thanks the gentleman. 
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The Chair now recognizes the gentleman from Florida, Mr. Claw- 
son. 

Mr. Clawson. Thank you for your time today, gentlemen. 

Following along this line of questioning, let’s see if my logic is 
right. The electrical grid and the power market is a private market 
in the United States: Heavy regulation, private shareholders, cus- 
tomers, suppliers, et cetera. Normally, in our country, when there 
is a technical or security issue that overlaps with the private sec- 
tor — ^Y2K comes to mind immediately. At least a couple, 2 or 3 of 
you all, are old enough to remember that. I certainly do. One or 
2 of you probably aren’t. We didn’t wait around for the Govern- 
ment. We were involved in fixing it for our own enterprise, and 
moreover, there were plenty of consulting companies and others 
that were involved in the fix in order to solve the problem because 
everybody had a profit incentive, which is normally what creates 
innovation and solution, as opposed to Government involvement. 

So, therefore, give me a summary here. I mean, the one thing — 
and I missed a lot of what has gone on today because I had con- 
stituents in my office, but nonetheless, if this is a real deal — and 
there seems to be some debate about it — but if there is a real deal, 
why isn’t there a real market response? Or is there a real market 
response, not just in terms of suppliers of product but also consult- 
ants and technical folks and all the people that would be working 
on this if it is the real deal? What is going on with the private sec- 
tor, to anyone that would like to answer? 

Mr. McClelland. I can start. There are really 2 aspects here. 
There is geomagnetic disturbance, which is inevitable. That is 
going to happen. It is just a matter of the timing of when it occurs 
and the magnitude that will occur. An impact from a geomagnetic 
disturbance has been debated. So the Commission, along the agen- 
cies, Department of Energy and Department of Homeland Security, 
put out a report by Oak Ridge National Lab that said that, consid- 
ering the current configuration of the system, if we took a 1921 
storm, the impacts would be devastating. We will see over 300 
transformers that could be potentially damaged or destroyed. These 
have a year-long lead time, in many cases custom-built for the site 
that they are installed with no spares. 

Mr. Clawson. By the way, if you have an incident, that 1-year 
lead time is going to go to 3 or 4. 

Mr. McClelland. Correct. 

Mr. Clawson. Because you don’t have enough capacity to make 
that, I mean, obviously. 

Mr. McClelland. You could even add to that that it is probably 
going to be a global event. The United States does not own or con- 
trol the production facilities, so those transformers may go to the 
international host where the factory is first, and then if there is 
any left over, the United States gets on the production list. 

Industry, however, conducted its own study and said that the 
grid would collapse before there would be problems to the trans- 
formers. There would be wide-spread blackouts, but the grid would 
collapse. It has been the subject of some back-and-forth through an 
iterative process that the Commission exercises. The bottom line 
conclusion, though, is even if the grid collapsed — in 1989, Quebec 
collapsed. It was 90 seconds; 7 million people were out of power for 
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9 hours. Relatively little damage, but the estimated cost for that 
1 collapse was $1 billion, $1-2 billion. If we use the lower number 
and we put in mitigation techniques to protect against it, we could 
protect 2,000 transformers for an incident that was relatively 
minor impact. By the way, Quebec has now mitigated against geo- 
magnetic disturbances. So, even with inevitability, there is still de- 
bate about what should be done and the costs that could be in- 
curred, which the Commission can reimburse those costs. 

On the EMP side, it is even more debatable because industry 
would need — they want — some sort of a risk analysis: How likely 
is it that some of these countries, and Brandon explained it — any- 
one that has nuclear capability would conceivably have an ability 
to propagate an EMP attack — how likely is it we are going to see 
this, and which facilities should we protect? The approach the 
Commission has used is to prioritize — along with DHS — is to 
prioritize those assets and, for a relatively small number of assets, 
encourage best practices, not pass more regulation but encourage 
best practices along with cost recovery to protect against these 
threats. 

Mr. Wales. I will only add that the science of hardening things 
against EMP is well-known. The military has been doing it since 
the dawn of the nuclear age when they wanted to harden their own 
systems to be able to withstand EMP in the event of war with Rus- 
sia, the Soviet Union. So the science is there on how to protect 
themselves. This is just an issue of whether it is a sufficient pri- 
ority for industry to make the investment, and then what is the 
best way for them to fund that, since they would have to go ask 
permission for every State utility commission to recover the cost 
that it would take to put in place those mitigation measures? 

Mr. Clawson. I guess the only thing I would say is if I am in 
the private sector and I have some savvy investors, I might be 
thinking of an innovation that puts your science that you are talk- 
ing about on its head. What innovators do is they find the next 
iteration of a more cost-effective solution so that we don’t sit 
around saying, “This is too expensive,” right? It just seems to me 
that somebody is out there doing something. If this is as big a deal 
as you say, there has got to be some X, Y, or Z company that is 
doing something for profit incentive to come up with a cheaper so- 
lution. 

I am out of time, so you can take me back. 

Mr. Perry. The Chair thanks the gentleman. 

The Chair now recognizes our guest, Mr. Eranks from Arizona. 

Mr. Eranks. Thank you, Mr. Chairman. 

I especially want to express gratitude just for the privilege of 
being your guest here today. The Chairman has, throughout the de- 
bate here for a number of years, been a champion in this area, and 
I am grateful. I suppose that it is not a small thing that the Chair- 
man, in other venues or forums, is recognized as General Perry. 
When we discussed our military, their response, there has never 
been an argument with the military. We have spent billions of dol- 
lars hardening some of our critical military assets, our critical de- 
fense assets. That is telling in my mind, because the military does 
depend upon the civilian grid in CONUS for about 99 percent of 
its electricity needs, without which, even according to their own 
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perspective, they cannot effect their mission. So I think that is a 
telling point, and I appreciate the whole panel here. A lot of very 
good questions. 

I am encouraged. I know that this is a subject that is rather 
daunting. The Israelis now have begun to harden their grid. They 
said that this is an attractive problem. You ask them, “What does 
that mean?” and they say, “Well, it is an existential issue for us.” 
I am not sure how that makes it attractive. But they said, “This 
is one we can fix,” which is kind-of an unusual situation for them. 

I am almost more encouraged about the testimony that I have 
heard from Mr. Currie and Mr. Wales and some of the acumen and 
the very learned perspective that they have brought forth because 
that hasn’t been the case in the past. I say that with all due re- 
spect. It gives me some hope. 

I think there are 2 things that are critical that we do. Other than 
making sure that we have properly done the research that is nec- 
essary and things of that nature going forward, I think CIPA in the 
Senate has a good chance of precipitating some of that research, 
and I hope that political considerations or gridlock does not prevent 
that, because if it gets a fair vote, it goes forward. But I really am 
truly encouraged by the testimony that I have heard today. 

Of course, Mr. Chairman, I consider Joe McClelland a National 
treasure. He has, ever since the EMP Commission first reported to 
the Armed Services Committee years ago, been a lone voice in 
many ways, and now his voice, of course, has been confirmed in so 
many different ways, and I am grateful for that. 

If we can do 2 things, if we can come up with a National stand- 
ard at which we should harden our grid, that we can all come to 
the conclusion based on sound science, and then use hardware- 
based solutions, which is what the SHIELD Act attempts to do, I 
think we can disincentivize either a particular enemy or certainly 
protect against a natural impact. If an enemy recognizes the poten- 
tial danger here, it has always been, at least historically speaking, 
their tendency to try to exploit that. 

Yes, I agree this is a low-probability, high-impact issue, but if 
one just does a cursory glance at history, you realize that those are 
the very kinds of things that we always find regret in not finding 
insight to at least prepare for them, because as we are now, I think 
we have an open invitation to some of our worst enemies if they 
choose to exploit that. 

So, with that, I am just going to ask one question and again ex- 
press the sincerest gratitude to you, Mr. Chairman, to everyone 
here, and to the panel, again, for the encouraging things that I am 
hearing. 

So, Mr. McClelland, I will ask the question to you, sir, and it has 
been asked in different ways. But in terms of what should be done 
and what is being done — that is probably the one element I would 
add to — right now, what do you think is being done, and where are 
we? Are we making progress? Are we seeing people expand their 
understanding of this issue? 

Again, thank you, Mr. Chairman. 

Mr. McClelland. Let’s start with what is being done. The Com- 
mission has established threshold standards, so foundational prac- 
tices for geomagnetic disturbances. They are based, though, on op- 
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erator actions. So that assumes 2 things: That the operators have 
sufficient warning — and in the case of a solar flare, it is assumed 
that they would have sufficient warning — to take precautions to re- 
configure the power grid to cause minimal impact to the power grid 
itself That depends on the operator not making an error and, 
again, the forecast. But that would not he sufficient for an electro- 
magnetic pulse attack. 

On the electromagnetic pulse side, more studies are being con- 
ducted by the industry. They are doing some research. They are 
now just starting to receive threat briefings, but very little has 
been done to protect the power grid and the other infrastructure 
against an electromagnetic pulse in the United States. 

Mr. Perry. Well, thank you, Mr. Franks. 

I guess this is going to remain a work in progress. Gentlemen, 
we appreciate your time here today. We can see that there are 
some places for improvement within the context of this. In some 
people’s minds, I imagine this is an imminent threat; in other peo- 
ple’s minds, it is something less than that. Also, in the context that 
it is hard-to-tell industry, I think, to move forward when you don’t 
have your own house in order, right? So we have got to do the best 
we can, whether it is FERC, whether it is the Department of En- 
ergy, whether it is Homeland Security, to make sure our ducks are 
in a row before we go to industry and say, “This is what we would 
like to see,” and then help them get there one way or another. So 
we have got to keep all that in context. Again, I think this is just 
going to be a continuing issue we will have to revisit to see that 
the benchmarks are being met and we keep moving forward to 
make sure that the grid is adequately protected and we are pre- 
pared for the eventuality of the, in some cases, imminent; the natu- 
rally occurring; or the maybe not-so-imminent, the other. 

With that, the Chair thanks the witnesses for their valuable tes- 
timony and the Members for their questions. Members may have 
some additional questions for the witnesses, and we will ask you 
to respond to these in writing. Pursuant to committee Rule Vll(e), 
the hearing record will remain open for 10 days. 

Without objection, the subcommittee stands adjourned. 

[Whereupon, at 11:17 a.m., the subcommittee was adjourned.] 




APPENDIX 


Questions From Chairman Scott Perry for Chris P. Currie 

Question la. The EMP Commission made 7 recommendations related to the elec- 
tric grid which were mainly focused on DHS and DOE. GAO has reported that of 
those 7 recommendations, DHS and DOE have taken “some action” on 4 rec- 
ommendations. In what ways have DHS and DOE further addressed those 4 rec- 
ommendations? 

Question lb. Do DHS and DOE intend to address the remaining 3? 

Answer. It is important to note that the actions DHS and DOE have taken to ad- 
dress electromagnetic risks are not part of a dedicated effort to implement the EMP 
Commission recommendations. Through our work, we identified actions taken by 
both agencies that aligned with some of the recommendations. Specifically, of the 
7 recommendations made by the EMP Commission related to the electric grid, some 
of the actions that DHS and DOE took aligned with 4 of them: 

1. Conducting research to better understand the interdependencies of critical in- 
frastructures, 

2. Addressing the vulnerability of control systems to an EMP attack, 

3. Identifying responsibilities for responding to an EMP attack, and 

4. Utilizing industry and other governmental institutions to assure the most 
cost-effective outcomes — (6 of 15 subparts). 

However, while some of DHS’s and DOE’s actions have aligned with 4 of the EMP 
Commission’s recommendations, this does not mean that each component of these 
4 recommendations has been completed. Examples of some of the actions DHS and 
DOE have taken include the following: 

• Developing National and regional restoration plans and assuring the avail- 
ability of critical communication channels. — DHS and DOE are in the process 
of developing the Power Outage Incident Annex (POLA) Plan. Although it’s not 
finalized — (expected completion is in 2016) — the POIA is intended to provide in- 
cident-specific information regarding how the Federal Government intends to 
respond to and recover from a loss of power resulting from deliberate acts of 
terrorism or natural disasters, including an EMP or geomagnetic disturbances 
(GMD) event. 

• Implementing efforts outlined in the National Space Weather Strategy and Ac- 
tion Plan. — DHS and DOE, among other Federal agencies, are in the process 
of identif 3 dng efforts and taking actions as outlined in the National Space 
Weather Strategy and Action Plan from October 2015. The strategy identifies 
goals and establishes the principles that will guide space weather efforts in both 
the near and long term, while the Action Plan identifies specific activities, out- 
comes, and time lines that the Federal Government will pursue accordingly. 
Specifically, the Action Plan calls for Federal agencies to establish benchmarks 
for space weather events and to improve protection and mitigation efforts, 
among other actions. 

• Conducting research on the susceptibility of transformers to geomagnetic disturb- 
ances (GMD). — In November 2015, DOE reported initiating a study by the Oak 
Ridge National Laboratory to quantify the risks associated with GMD on elec- 
tric power system reliability. The study plans to identify power lines and their 
associated transformers within the eastern section of the power grid and to de- 
termine those that are most susceptible to the effects of GMD. DOE officials ex- 
pect the study to be completed in July 2016. 

• Developing a National Transformer Strategy. — DOE developed a draft National 
strategy in 2015 to reduce the risk to grid reliability posed by the loss of critical 
large power transformers. The draft National strategy focuses on 3 areas: (1) 
Understanding and mitigating current and future risks to transformers, (2) en- 
hancing protection of transformers, and (3) ensuring transformer replacement 
equipment is available. It also calls upon Federal Government entities, to part- 
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ner with electricity operators, equipment manufacturers, and State and local 
authorities to develop risk assessments and modeling tools to guide their efforts 
and prioritize activities. As of December 2015, DOE officials reported that the 
strategy is undergoing review. 

DHS and DOE intent to address the remaining 3 EMP Commission recommenda- 
tions remains unclear. There are some indications though that issues included in 
the recommendations are being given consideration. For example, both departments 
acknowledged the importance of providing capabilities to recover rapidly from an 
EMP attack — which is encompassed in 1 of the 3 remaining recommendations. In 
addition, DOE officials also identified “black start capabilities” — the ability to re- 
start power at a generation plant that has lost power without having to use an ex- 
ternal energy source — as an example of how to restart energy production. This capa- 
bility is also discussed in 1 of the Commission’s recommendations where some action 
has been taken but several actions remain incomplete. DHS officials have agreed 
that an analysis of black start capabilities is warranted. 

Question 2a. A recent Idaho National Laboratory study found that updated re- 
search and analysis on the effects of the early time pulse of an EMP event is need- 
ed. In your estimation, how much of the other existing EMP research is outdated? 

Question 2b. Given that research projects can take a lot of time to complete, what 
steps can the Federal Government take to fill any existing knowledge gaps caused 
by outdated information? 

Answer. 

• A key knowledge gap is in understanding how an EMP will affect the U.S. elec- 
tric grid. The INL report noted that most information sources about the impact 
of EMP El on electric power grids are decades-old and do not account for mod- 
ern grid technologies and electronic control systems. While we have been told 
that the DOD and the intelligence community have updated information on the 
EMP threat, additional opportunities may exist to leverage EMP threat infor- 
mation through I&A or direct collaboration with DOD, DOE, or other intel- 
ligence sources. For example, Classified analytical products are available that 
address specific components of threat, such as assessment of EMP-related mis- 
sile technologies, which could provide an important input regarding adversary 
capabilities as part of DHS’s overall assessment of electromagnetic threats. Al- 
though I&A officials have direct access to these materials, neither I&A nor 
NPPD officials identified efforts to specifically leverage this information as part 
of any Department-wide risk assessment efforts. Acquiring more comprehensive 
information on potential EMP threats may be helpful because, as one EMP ex- 
pert stated in recent testimony, there are misconceptions regarding the nature 
and impact of potential EMP attacks, which may have a negative effect on the 
ability of stakeholders to determine reasonable steps needed to protect critical 
infrastructure and mitigate potential impacts. Additionally, as we reported, 
while the NPPD Office of Infrastructure Protection conducts various assess- 
ments to identify vulnerabilities, interdependencies, and potential cascading im- 
pacts across different sectors of the Nation’s critical infrastructure, these have 
generally not been utilized to obtain specific information about vulnerabilities 
or consequences related to EMP or GMD events. Given the lack of comprehen- 
sive EMP-related information on the vulnerability of and consequences to the 
U.S. electric grid, further R&D to understand the effects, and techniques to pro- 
tect against or mitigate the effects of EMP attacks is needed. In our report, we 
recommended that the Secretaries of Homeland Security and of Energy engage 
with Federal partners and industry stakeholders to identify and implement key 
EMP R&D priorities. 

• As we also stated in our report, a 2013 white paper developed by the Electric 
Power Research Institute also noted a lack of wide-spread and coordinated re- 
search and development efforts to protect the commercial electric grid against 
EMP attacks and mitigate their effects. The institute recommended that stake- 
holders define key characteristics of an EMP event — such as potential altitudes 
of detonation — for further study of corresponding impacts, as the lack of more 
specific parameters for determining potential EMP effects makes it difficult to 
develop applicable protective guidelines and equipment design specifications. 
However, according to Federal Energy Regulatory Commission officials, addi- 
tional work is being done outside of the United States to further develop appli- 
cable standards and implement equipment designed to mitigate the effects of 
or protect against EMP risks. Given the on-going nature of this work, U.S. offi- 
cials may have an opportunity to investigate how they might be able to coordi- 
nate with researchers outside the United States already conducting this work 
to determine if working jointly could speed the completion of this research for 
the benefit of both parties. 
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• Similarly, any proposed mitigation strategies resulting from efforts to address 
GMD, including the National Space Weather Action Plan, could also be re- 
viewed to determine how effective they might be against a potential EMP attack 
so that fully-informed investment decisions can be made. For example, as one 
EMP expert noted in recent Congressional testimony, if designing protective 
equipment to withstand specified levels of E3 effects from an EMP attack, there 
may be collateral benefits for providing protection against GMD effects; how- 
ever, the reverse may not be true. 

• We also reported that Federal agencies should improve their efforts to identify 
and prioritize key research and development, including an evaluation of protec- 
tive equipment intended to help mitigate the impacts of an EMP event. As we 
recommended in our report. Federal agencies and industry stakeholders should 
work together to identify and implement key EMP research and development 
priorities, including EMP protection and mitigation options. Coordinating their 
efforts can also help to better ensure that limited resources are more effectively 
targeted toward the highest-priority research. 

Questions From Chairman Scott Perry for Brandon Wales 

Question 1. According to GAO’s report, actions are underway to establish a Cyber, 
Infrastructure, and Resiliency group within the Office of Policy. How will this group 
differ from other offices, such as NPPD’s Office of Cybersecurity and Communica- 
tions or Office of Cyber and Infrastructure Analysis, which have already performed 
work in regard to EMP threats? 

Answer. Response was not received at the time of publication. 

Question 2. Is DHS reviewing those EMP Commission recommendations that have 
not been addressed? If so, what is being done to address them? 

Answer. Response was not received at the time of publication. 

Question 3. GAO recommended that DHS increase its collection and analysis of 
threat, vulnerability, and consequence information related to electromagnetic risks. 
GAO also provided a variety of methods through which this can be accomplished, 
including closer collaboration with DOD and leveraging existing assessment tools, 
such as the Infrastructure Survey Tool. What has DHS done to increase its collec- 
tion and analysis of electromagnetic threat information? 

Answer. Response was not received at the time of publication. 

Question From Chairman Scott Perry for Joseph McClelland 

Question. Has FERC assessed the potential costs of mitigating critical electric as- 
sets to withstand a GMD or EMP? If so, what are they and are there funding 
streams that could be shifted for some of these costs? 

Answer. FERC has not itself assessed the potential costs of mitigating critical 
electric assets to withstand a GMD or EMP event. A study conducted by the Oak 
Ridge National Laboratory in 2010, sponsored by FERC and other Federal agencies 
and to which I referred in my prepared testimony, includes some estimates of such 
costs. 
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